x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/03/21/3 | Mailing List Third Party Advisory |
| http://xenbits.xen.org/xsa/advisory-429.html | Vendor Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L6PM4RE7MUE6OWA32ZVOXCP235RM2TM/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APBMS2Q6746AXAFAITNJMGBNFGNMVLWR/ | Mailing List Third Party Advisory |
| https://security.gentoo.org/glsa/202402-07 | |
| https://www.debian.org/security/2023/dsa-5378 | Third Party Advisory |
| https://xenbits.xenproject.org/xsa/advisory-429.txt | Vendor Advisory |
Configurations
History
27 Mar 2023, 14:10
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | (MLIST) http://www.openwall.com/lists/oss-security/2023/03/21/3 - Mailing List, Third Party Advisory | |
| References | (MISC) https://xenbits.xenproject.org/xsa/advisory-429.txt - Vendor Advisory | |
| References | (CONFIRM) http://xenbits.xen.org/xsa/advisory-429.html - Vendor Advisory | |
| CPE | cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
21 Mar 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-03-21 13:15
Updated : 2024-02-04 08:15
NVD link : CVE-2022-42331
Mitre link : CVE-2022-42331
CVE.ORG link : CVE-2022-42331
JSON object : View
Products Affected
fedoraproject
- fedora
xen
- xen
CWE