CVE-2022-42328

Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).

• CWE-667
• CWE-667

• http://www.openwall.com/lists/oss-security/2022/12/08/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/08/3Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/09/2Mailing List, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00031.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00034.htmlMailing List, Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-424.txtThird Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/08/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/08/3Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2022/12/09/2Mailing List, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00031.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/12/msg00034.htmlMailing List, Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-424.txtThird Party Advisory

Published

Dec 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42322Xenstore: Cooperating guests can create arbitrary numbers of…5.5
• CVE-2022-42323Xenstore: Cooperating guests can create arbitrary numbers of…5.5
• CVE-2022-42324Oxenstored 32->31 bit integer truncation issues Integers in …5.5
• CVE-2022-42325Xenstore: Guests can create arbitrary number of nodes via tr…5.5
• CVE-2022-42326Xenstore: Guests can create arbitrary number of nodes via tr…5.5
• CVE-2022-42327x86: unintended memory sharing between guests On Intel syste…7.1
• CVE-2022-42329Guests can trigger deadlock in Linux netback driver T[his CN…5.5
• CVE-2022-4233A vulnerability has been found in SourceCodester Event Regis…6.1
• CVE-2022-42330Guests can cause Xenstore crash via soft reset When a guest …7.5
• CVE-2022-42331x86: speculative vulnerability in 32bit SYSCALL path Due to …5.5
• CVE-2022-42332x86 shadow plus log-dirty mode use-after-free In environment…7.8
• CVE-2022-42333x86/HVM pinned cache attributes mis-handling T[his CNA infor…8.6