Every CVE Search/ Get API key

CVE-2022-35414

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail...

8.8 HighFix availableDisputed

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.66%Down 0.4 points since Jul 11, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Record
CVE-2022-35414
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
6.1 MediumAV:L/AC:L/Au:N/C:P/I:P/A:C
Weakness
CWE-908
Updated
2026-11-02
CVE List No score

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Record
CVE-2022-35414
Updated
2026-11-02
EUVDEUVD-2022-38302 No score

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Record
EUVD-2022-38302
Updated
2026-11-03
GitHub AdvisoriesGHSA-78j4-r4gh-xcm9 8.8

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail...

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash.

Record
GHSA-78j4-r4gh-xcm9
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-908
Updated
2026-11-02
OSVAZL-10110 8.8

CVE-2022-35414 affecting package qemu for versions less than 6.2.0-7

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Record
AZL-10110
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-35161 8.8

CVE-2022-35414 affecting package qemu for versions less than 6.2.0-18

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Record
AZL-35161
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVBELL-CVE-2022-35414 8.8

CVE-2022-35414 does not affect BellSoft software

Record
BELL-CVE-2022-35414
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-1791 8.2

qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash.(CVE-2022-35414)

Record
OESA-2022-1791
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSV No score

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Record
CVE-2022-35414
Updated
2026-11-02
OSVDEBIAN-CVE-2022-35414 No score

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Record
DEBIAN-CVE-2022-35414
Updated
2026-11-03
OSVopenSUSE-SU-2024:12209-1 No score

qemu-7.0.0-53.1 on GA media

These are all security issues fixed in the qemu-7.0.0-53.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12209-1
Updated
2026-11-02
OSVSUSE-SU-2022:3594-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2021-3409: Fixed an incomplete fix for CVE-2020-17380 and CVE-2020-25085 in sdhi controller. (bsc#1182282)
  • CVE-2021-4206: Fixed an integer overflow in cursor_alloc which can lead to heap buffer overflow. (bsc#1198035)
  • CVE-2021-4207: Fixed a double fetch in qxl_cursor ehich can lead to heap buffer overflow. (bsc#1198037)
  • CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)
  • CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)
Record
SUSE-SU-2022:3594-1
Updated
2026-11-02
OSVSUSE-SU-2022:3660-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)
  • CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)
Record
SUSE-SU-2022:3660-1
Updated
2026-11-02
OSVSUSE-SU-2022:3768-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2021-3409: Fixed an incomplete fix for CVE-2020-17380 and CVE-2020-25085 in sdhi controller. (bsc#1182282)
  • CVE-2021-4206: Fixed an integer overflow in cursor_alloc which can lead to heap buffer overflow. (bsc#1198035)
  • CVE-2021-4207: Fixed a double fetch in qxl_cursor ehich can lead to heap buffer overflow. (bsc#1198037)
  • CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)
  • CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)
  • CVE-2021-3507: Fixed a heap buffer overflow in DMA read data transfers. (bsc#1185000)
  • CVE-2020-17380: Fixed a heap buffer overflow in sdhci_sdma_transfer_multi_blocks. (bsc#1175144)
Record
SUSE-SU-2022:3768-1
Updated
2026-11-02
OSVSUSE-SU-2022:3795-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)
  • CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)
Record
SUSE-SU-2022:3795-1
Updated
2026-11-02
OSVSUSE-SU-2023:0761-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • bsc#1172033 (CVE-2020-13253)

  • bsc#1180207 (CVE-2020-14394)

  • bsc#1172382 (CVE-2020-13754)

  • bsc#1198038 (CVE-2022-0216)

  • bsc#1193880 (CVE-2021-3929)

  • bsc#1197653 (CVE-2022-1050)

  • bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)

  • bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409), bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414

  • About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)

  • bsc#1198035, CVE-2021-4206

Record
SUSE-SU-2023:0761-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu
Azure Linux:2
 before 6.2.0-7
6.2.0-7
qemu
Azure Linux:3
 before 6.2.0-18
6.2.0-18
qemu
Debian:12
 before 1:7.1+dfsg-1
1:7.1+dfsg-1
qemu
Debian:13
 before 1:7.1+dfsg-1
1:7.1+dfsg-1
qemu
Debian:14
 before 1:7.1+dfsg-1
1:7.1+dfsg-1
qemu
Debian:10
From an advisory covering 35 CVEs
 before 1:3.1+dfsg-8+deb10u9, plus listed versions
1:3.1+dfsg-81:3.1+dfsg-8+deb10u21:3.1+dfsg-8+deb10u31:3.1+dfsg-8+deb10u41:3.1+dfsg-8+deb10u5
Show 4 moreShow less
1:3.1+dfsg-8+deb10u61:3.1+dfsg-8+deb10u71:3.1+dfsg-8+deb10u81:3.1+dfsg-8~deb10u1
1:3.1+dfsg-8+deb10u9
qemu
openEuler:20.03-LTS-SP1
 before 4.1.0-67.oe1
4.1.0-67.oe1
qemu
openEuler:20.03-LTS-SP3
 before 4.1.0-71.oe1
4.1.0-71.oe1
qemu
openEuler:22.03-LTS
 before 6.2.0-44.oe2203
6.2.0-44.oe2203
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
Show 34 moreShow less
Affected packages
PackageAffectedFixed
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Manager Proxy 4.1
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Manager Server 4.1
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Enterprise Storage 7
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
openSUSE:Leap 15.3
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
openSUSE:Leap 15.4
From an advisory covering 5 CVEs
 before 4.2.1-150200.69.1
4.2.1-150200.69.1
qemu
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 2 CVEs
 before 5.2.0-150300.118.3
5.2.0-150300.118.3
qemu
SUSE:Linux Enterprise Module for Server Applications 15 SP3
From an advisory covering 2 CVEs
 before 5.2.0-150300.118.3
5.2.0-150300.118.3
qemu
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 2 CVEs
 before 5.2.0-150300.118.3
5.2.0-150300.118.3
qemu
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 2 CVEs
 before 5.2.0-150300.118.3
5.2.0-150300.118.3
qemu
openSUSE:Leap Micro 5.2
From an advisory covering 2 CVEs
 before 5.2.0-150300.118.3
5.2.0-150300.118.3
qemu
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 5.2.0-150300.118.3
5.2.0-150300.118.3
qemu-linux-user
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 5.2.0-150300.118.2
5.2.0-150300.118.2
qemu-testsuite
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 5.2.0-150300.118.5
5.2.0-150300.118.5
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Enterprise Storage 6
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
openSUSE:Leap 15.3
From an advisory covering 7 CVEs
 before 3.1.1.1-150100.80.43.2
3.1.1.1-150100.80.43.2
qemu
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 6.2.0-150400.37.8.2
6.2.0-150400.37.8.2
qemu
SUSE:Linux Enterprise Module for Basesystem 15 SP4
From an advisory covering 2 CVEs
 before 6.2.0-150400.37.8.2
6.2.0-150400.37.8.2
qemu
SUSE:Linux Enterprise Module for Server Applications 15 SP4
From an advisory covering 2 CVEs
 before 6.2.0-150400.37.8.2
6.2.0-150400.37.8.2
qemu
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 6.2.0-150400.37.8.2
6.2.0-150400.37.8.2
qemu-linux-user
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 6.2.0-150400.37.8.1
6.2.0-150400.37.8.1
qemu-testsuite
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 6.2.0-150400.37.8.4
6.2.0-150400.37.8.4
qemu
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 14 CVEs
 before 3.1.1.1-66.1
3.1.1.1-66.1
qemu
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 14 CVEs
 before 3.1.1.1-66.1
3.1.1.1-66.1
qemu
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 7.0.0-53.1
7.0.0-53.1

History

History
RecordedChangedSources
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-35414 is a high vulnerability (CVSS 8.8) in Qemu, published July 11, 2022. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in qemu 6.2.0-7.

References

Show 47 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open