{"id":"CVE-2022-42335","aliases":["ALPINE-CVE-2022-42335","DEBIAN-CVE-2022-42335","EUVD-2022-45410","GHSA-pwx9-2gvj-242v","SUSE-SU-2023:2535-1","UBUNTU-CVE-2022-42335","openSUSE-SU-2024:12917-1"],"status":"published","title":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address...","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00264,"percentile":0.18468,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2023-04-25T00:00:00Z","modified":"2026-11-03T08:03:55Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.17.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.17.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.17.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.17.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.17.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.17.0-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.17.0-r5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.17.1+2-gb773c48e36-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.17.1+2-gb773c48e36-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.17.1+2-gb773c48e36-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xen","fixed_in":["4.17.1_02-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-r5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1+2-gb773c48e36-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1+2-gb773c48e36-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1+2-gb773c48e36-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1_04-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1_04-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1_04-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0-1ubuntu1","4.20.0+68-g35cb38b222-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.1_02-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-430.txt","tags":["x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://xenbits.xen.org/xsa/advisory-430.html","tags":["x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/04/25/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PSPFWSY6UOPGMADQGOGN2PAAS5LJRPTG/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202402-07","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42335"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PSPFWSY6UOPGMADQGOGN2PAAS5LJRPTG/"},{"url":"https://github.com/advisories/GHSA-pwx9-2gvj-242v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-42335","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-42335","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232535-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1208736","tags":["report"]},{"url":"https://bugzilla.suse.com/1209237","tags":["report"]},{"url":"https://bugzilla.suse.com/1209245","tags":["report"]},{"url":"https://bugzilla.suse.com/1210315","tags":["report"]},{"url":"https://bugzilla.suse.com/1210570","tags":["report"]},{"url":"https://bugzilla.suse.com/1211433","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42336","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-42335","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/04/25/1","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-430.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42335","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-42335","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2024-08-03T13:03:45.932Z","updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-45410","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2024-08-03T13:03:45Z","updated_at":"2026-11-03T03:25:19.130756Z"}],"ghsa":[{"id":"GHSA-pwx9-2gvj-242v","title":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address...","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","status":"published","published":"2023-04-25T15:30:27Z","modified":"2024-02-04T09:30:41Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:55:33.593991Z"}],"nvd":[{"id":"CVE-2022-42335","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","status":"published","published":"2023-04-25T13:15:09.643Z","modified":"2026-06-17T05:04:45.06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:37.42466Z"}],"osv":[{"id":"ALPINE-CVE-2022-42335","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","status":"published","published":"2023-04-25T13:15:09.643Z","modified":"2026-11-03T07:18:33.750750444Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-42335","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","status":"published","published":"2023-04-25T13:15:09.643Z","modified":"2026-03-15T22:00:48.293219Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"DEBIAN-CVE-2022-42335","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","status":"published","published":"2023-04-25T13:15:09.643Z","modified":"2026-11-03T08:03:55.362246038Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"UBUNTU-CVE-2022-42335","description":"x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.","status":"published","published":"2023-04-25T13:15:00Z","modified":"2026-10-17T12:56:22.673406127Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"openSUSE-SU-2024:12917-1","title":"xen-4.17.1_02-1.1 on GA media","description":"These are all security issues fixed in the xen-4.17.1_02-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:05:44.659087Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:2535-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2022-42336: Fix an issue where guests configuring AMD\n  Speculative Store Bypass Disable would have no effect (XSA-431)\n  (bsc#1211433).\n- CVE-2022-42335: Fixed an issue where guests running under shadow\n  mode with a PCI devices passed through could force the hypervisor\n  to dereference arbitrary memory, leading to a denial of service\n  (XSA-430) (bsc#1210315).\n\nNon-security fixes:\n\n- Fixed a build warning false positive (bsc#1210570).\n- Added missing debug-info to xen-syms (bsc#1209237).\n- Updated to version 4.17.1 (bsc#1027519).\n- Fixed a failure during VM destruction when using host-assisted kexec\n  and kdump (bsc#1209245).\n- Other upstream fixes (bsc#1027519).\n","status":"published","published":"2023-06-19T07:52:01Z","modified":"2025-05-02T04:33:42.170801Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}