certfr_avis - certfr-2022-avi-1018

CERTFR-2022-AVI-1018

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Xen. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Xen versions xen-unstable antérieures à xsa422/xsa422-x.patch
Xen versions Xen 4.16.x antérieures à xsa422/xsa422-4.16-x.patch
Xen versions Xen 4.15.x antérieures à xsa422/xsa422-4.15-x.patch
Xen versions Xen 4.14.x antérieures à xsa422/xsa422-4.14-x.patch
Xen versions Xen 4.13.x antérieures à xsa422/xsa422-4.13-x.patch

Seulement les processeurs AMD ainsi que certaines microarchitectures sont affectés par cette vulnérabilité.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Xen du 08 novembre 2022

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eXen versions xen-unstable ant\u00e9rieures \u00e0 xsa422/xsa422-x.patch\u003c/li\u003e \u003cli\u003eXen versions Xen 4.16.x ant\u00e9rieures \u00e0 xsa422/xsa422-4.16-x.patch\u003c/li\u003e \u003cli\u003eXen versions Xen 4.15.x ant\u00e9rieures \u00e0 xsa422/xsa422-4.15-x.patch\u003c/li\u003e \u003cli\u003eXen versions Xen 4.14.x ant\u00e9rieures \u00e0 xsa422/xsa422-4.14-x.patch\u003c/li\u003e \u003cli\u003eXen versions Xen 4.13.x ant\u00e9rieures \u00e0 xsa422/xsa422-4.13-x.patch\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eSeulement les processeurs AMD ainsi que certaines microarchitectures sont affect\u00e9s par cette vuln\u00e9rabilit\u00e9.\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-23824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23824"
    }
  ],
  "initial_release_date": "2022-11-10T00:00:00",
  "last_revision_date": "2022-11-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-1018",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-11-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Xen. Elle permet \u00e0 un attaquant\nde provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Xen",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Xen du 08 novembre 2022",
      "url": "https://xenbits.xen.org/xsa/advisory-422.html"
    }
  ]
}

CVE-2022-23824 (GCVE-0-2022-23824)

Vulnerability from cvelistv5

Published

2022-11-09 20:48

Modified

2025-02-13 16:32

Severity ?

CWE

Summary

IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.

References

URL

Tags

	https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1040
	http://www.openwall.com/lists/oss-security/2022/11/10/2	mailing-list
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTQMPJC5N6XJYQ232OZFLK47HVZNRBY3/	vendor-advisory
	https://www.debian.org/security/2023/dsa-5378	vendor-advisory
	https://security.gentoo.org/glsa/202402-07

Impacted products

	Vendor	Product	Version
	AMD	AMD Processors	Version: Processor various

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:51:46.071Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1040"
          },
          {
            "name": "[oss-security] 20221110 Xen Security Advisory 422 v2 (CVE-2022-23824) - x86: Multiple speculative security issues",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/11/10/2"
          },
          {
            "name": "FEDORA-2022-9f51d13fa3",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
          },
          {
            "name": "FEDORA-2022-53a4a5dd11",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTQMPJC5N6XJYQ232OZFLK47HVZNRBY3/"
          },
          {
            "name": "DSA-5378",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5378"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202402-07"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AMD Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "affected",
              "version": "Processor  various"
            }
          ]
        }
      ],
      "datePublic": "2022-11-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "NA",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-17T01:23:48.000Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1040"
        },
        {
          "name": "[oss-security] 20221110 Xen Security Advisory 422 v2 (CVE-2022-23824) - x86: Multiple speculative security issues",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/11/10/2"
        },
        {
          "name": "FEDORA-2022-9f51d13fa3",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
        },
        {
          "name": "FEDORA-2022-53a4a5dd11",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTQMPJC5N6XJYQ232OZFLK47HVZNRBY3/"
        },
        {
          "name": "DSA-5378",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5378"
        },
        {
          "url": "https://security.gentoo.org/glsa/202402-07"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2022-23824",
    "datePublished": "2022-11-09T20:48:06.826Z",
    "dateReserved": "2022-01-21T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:32:23.589Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2022-AVI-1018

Vulnerability from certfr_avis

Solution

CVE-2022-23824 (GCVE-0-2022-23824)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature