CVE-2022-46770

qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users...

7.5 HighPublic exploitFix available

qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafted multicast UDP packet (IP address range of 224.0.0.0 through 239.255.255.255).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

22.4%Up 21.5 points since Dec 8, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2022-46770
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

CVE List 7.5

Record: CVE-2022-46770
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

EUVDEUVD-2022-49552 7.5

Record: EUVD-2022-49552
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6vx5-8rxp-jw26 7.5

qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users...

Record: GHSA-6vx5-8rxp-jw26
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-835
Updated: 2026-11-02

OSV 7.5

Record: CVE-2022-46770
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOSEC-2022-01 7.5

Infinite loop in console output on xen

Background

MirageOS is a library operating system using cooperative multitasking, which can be executed as a guest of the Xen hypervisor. Output on the console is performed via the Xen console protocol. Problem Description

Since MirageOS moved from PV mode to PVH, and thus replacing Mini-OS with solo5, there was an issue in the solo5 code which failed to properly account the already written bytes on the console. This only occurs if the output to be performed does not fit in a single output buffer (2048 bytes on Xen).

The code in question set the number of bytes written to the last written count (written = output_some(buf)), instead of increasing the written count (written += output_some(buf)).

Impact

Console output may lead to an infinite loop, endlessly printing data onto the console.

A prominent unikernel is the Qubes MirageOS firewall, which prints some input packets onto the console. This can lead to a remote denial of service vulnerability, since any client could send a malformed and sufficiently big network packet.

Solution

The solution is to fix the console output code in solo5, as done in https://github.com/Solo5/solo5/pull/538/commits/099be86f0a17a619fcadbb970bb9e511d28d3cd8

Timeline

2022-12-04: initial report by Krzysztof Burghardt https://github.com/mirage/qubes-mirage-firewall/issues/166
2022-12-04: investigation by Hannes Mehnert and Pierre Alain
2022-12-05: initial fix by Pierre Alain https://github.com/Solo5/solo5/pull/538
2022-12-05: review of fix by Thomas Leonard
2022-12-07: release of fixed packages and security advisory

Record: OSEC-2022-01
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

Affected products

linuxfoundation mirage firewall

Affected packages

Affected packages
Package	Affected	Fixed
`solo5` opam	0.6.6 up to 0.7.5, plus listed versions 0.7.00.7.10.7.20.7.30.7.4	0.7.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS)	2023-03-31
Metasploit	Mirage firewall for QubesOS 0.8.0-0.8.3 Denial of Service (DoS) Exploit	2022-12-04

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-46770 is a high vulnerability (CVSS 7.5) in Linuxfoundation Mirage Firewall, published December 7, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 22.4%, the 97th percentile. Fixed in solo5 0.7.5.