CVE-2022-42327

x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist between two guests.

• CWE-284

• http://www.openwall.com/lists/oss-security/2022/11/01/3Mailing List, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-412.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
• https://security.gentoo.org/glsa/202402-07
• https://xenbits.xenproject.org/xsa/advisory-412.txtVendor Advisory
• http://www.openwall.com/lists/oss-security/2022/11/01/3Mailing List, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-412.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
• https://security.gentoo.org/glsa/202402-07
• https://xenbits.xenproject.org/xsa/advisory-412.txtVendor Advisory

Published

Nov 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42321Xenstore: Guests can crash xenstored via exhausting the stac…6.5
• CVE-2022-42322Xenstore: Cooperating guests can create arbitrary numbers of…5.5
• CVE-2022-42323Xenstore: Cooperating guests can create arbitrary numbers of…5.5
• CVE-2022-42324Oxenstored 32->31 bit integer truncation issues Integers in …5.5
• CVE-2022-42325Xenstore: Guests can create arbitrary number of nodes via tr…5.5
• CVE-2022-42326Xenstore: Guests can create arbitrary number of nodes via tr…5.5
• CVE-2022-42328Guests can trigger deadlock in Linux netback driver T[his CN…5.5
• CVE-2022-42329Guests can trigger deadlock in Linux netback driver T[his CN…5.5
• CVE-2022-4233A vulnerability has been found in SourceCodester Event Regis…6.1
• CVE-2022-42330Guests can cause Xenstore crash via soft reset When a guest …7.5
• CVE-2022-42331x86: speculative vulnerability in 32bit SYSCALL path Due to …5.5
• CVE-2022-42332x86 shadow plus log-dirty mode use-after-free In environment…7.8