CVE - CVE-2022-35414

CVE-ID
CVE-2022-35414	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
DISPUTED softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time."
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.c MISC:https://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148 MISC:https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482 MISC:https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aa MISC:https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c MISC:https://gitlab.com/qemu-project/qemu/-/issues/1065 MISC:https://sick.codes/sick-2022-113 MISC:https://www.mail-archive.com/qemu-devel@nongnu.org/msg895266.html MISC:https://www.qemu.org/docs/master/system/security.html#non-virtualization-use-case MLIST:[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update URL:https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
Assigning CNA
MITRE Corporation
Date Record Created
20220711	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20220711)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)