CVE-2022-35414

Name
CVE-2022-35414
Description
** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time."
NVD Severity
high
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://www.mail-archive.com/qemu-devel@nongnu.org/msg895266.html
MISC https://gitlab.com/qemu-project/qemu/-/issues/1065
MISC https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c
MISC https://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148
MISC https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aa
MISC https://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.c
MISC https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482
MISC https://sick.codes/sick-2022-113
MLIST https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
MISC https://www.qemu.org/docs/master/system/security.html#non-virtualization-use-case

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* qemu >= 4.1.50 <= 7.0.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
qemu 3.16-community 7.0.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable