NVD Vulnerability Detail

CVE-2022-42331

Summary	x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks.
Publication Date	March 21, 2023, 10:15 p.m.
Registration Date	March 22, 2023, 10 a.m.
Last Update	Nov. 21, 2024, 4:24 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:xen:xen:::::::x86:*		4.5.0	4.17.0

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2023/03/21/3	Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2023/03/21/3	Mailing List Third Party Advisory
3	http://xenbits.xen.org/xsa/advisory-429.html	Vendor Advisory
4	http://xenbits.xen.org/xsa/advisory-429.html	Vendor Advisory
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L6PM4RE7MUE6OWA32ZVOXCP235RM2TM/	Mailing List Third Party Advisory
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L6PM4RE7MUE6OWA32ZVOXCP235RM2TM/	Mailing List Third Party Advisory
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APBMS2Q6746AXAFAITNJMGBNFGNMVLWR/	Mailing List Third Party Advisory
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APBMS2Q6746AXAFAITNJMGBNFGNMVLWR/	Mailing List Third Party Advisory
9	https://security.gentoo.org/glsa/202402-07
10	https://security.gentoo.org/glsa/202402-07
11	https://www.debian.org/security/2023/dsa-5378	Third Party Advisory
12	https://www.debian.org/security/2023/dsa-5378	Third Party Advisory
13	https://xenbits.xenproject.org/xsa/advisory-429.txt	Vendor Advisory
14	https://xenbits.xenproject.org/xsa/advisory-429.txt	Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Xen プロジェクトの Xen 他複数ベンダの製品における脆弱性

Title	Xen プロジェクトの Xen 他複数ベンダの製品における脆弱性
Summary	Xen プロジェクトの Xen 他複数ベンダの製品には、不特定の脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	Oct. 3, 2022, midnight
Registration Date	Nov. 10, 2023, 11:44 a.m.
Last Update	Nov. 10, 2023, 11:44 a.m.

Affected System

Fedora Project

Fedora 37

Fedora 38

Xen プロジェクト

Xen 4.5.0 から 4.17.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2022-42331	https://www.cve.org/CVERecord?id=CVE-2022-42331
National Vulnerability Database (NVD)
2	CVE-2022-42331	https://nvd.nist.gov/vuln/detail/CVE-2022-42331

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/scap/cwe.html

その他

No	Name	URL
関連文書
1	lists.fedoraproject.org (5L6PM4RE7MUE6OWA32ZVOXCP235RM2TM)	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L6PM4RE7MUE6OWA32ZVOXCP235RM2TM/
2	lists.fedoraproject.org (APBMS2Q6746AXAFAITNJMGBNFGNMVLWR)	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APBMS2Q6746AXAFAITNJMGBNFGNMVLWR/
3	www.debian.org (dsa-5378)	https://www.debian.org/security/2023/dsa-5378
4	www.openwall.com (oss-security/2023/03/21/3)	http://www.openwall.com/lists/oss-security/2023/03/21/3
5	xenbits.xen.org (advisory-429)	http://xenbits.xen.org/xsa/advisory-429.html
6	xenbits.xenproject.org (advisory-429.txt)	https://xenbits.xenproject.org/xsa/advisory-429.txt

Change Log

No	Changed Details	Date of change
1	[2023年11月10日] 掲載	Nov. 10, 2023, 11:44 a.m.