CVEvulnerability

CVE-2022-33741

7.1 HIGH Published 2022-07-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0 ([email protected])
3.6 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:P
Weaknesses
CWE-200

Description

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

Affected configurations

• fedoraproject fedora 35 • fedoraproject fedora 36 • debian debian linux 10.0 • debian debian linux 11.0 • linux linux kernel (>= 2.6.13 < 4.9.322) • linux linux kernel (>= 4.14 < 4.14.287) • linux linux kernel (>= 4.19 < 4.19.251) • linux linux kernel (>= 5.4 < 5.4.204) • linux linux kernel (>= 5.10 < 5.10.129) • linux linux kernel (>= 5.15 < 5.15.53) • linux linux kernel (>= 5.18 < 5.18.10) • linux linux kernel 2.6.12 • linux linux kernel 5.19 • xen xen

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References