CVE-2022-42335

x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.

• CWE-476

• http://www.openwall.com/lists/oss-security/2023/04/25/1Mailing List, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-430.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PSPFWSY6UOPGMADQGOGN2PAAS5LJRPTG/
• https://security.gentoo.org/glsa/202402-07
• https://xenbits.xenproject.org/xsa/advisory-430.txtPatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2023/04/25/1Mailing List, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-430.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PSPFWSY6UOPGMADQGOGN2PAAS5LJRPTG/
• https://security.gentoo.org/glsa/202402-07
• https://xenbits.xenproject.org/xsa/advisory-430.txtPatch, Vendor Advisory

Published

Apr 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4233A vulnerability has been found in SourceCodester Event Regis…6.1
• CVE-2022-42330Guests can cause Xenstore crash via soft reset When a guest …7.5
• CVE-2022-42331x86: speculative vulnerability in 32bit SYSCALL path Due to …5.5
• CVE-2022-42332x86 shadow plus log-dirty mode use-after-free In environment…7.8
• CVE-2022-42333x86/HVM pinned cache attributes mis-handling T[his CNA infor…8.6
• CVE-2022-42334x86/HVM pinned cache attributes mis-handling T[his CNA infor…6.5
• CVE-2022-42336Mishandling of guest SSBD selection on AMD hardware The curr…3.3
• CVE-2022-42337Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-42338Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-42339Adobe Acrobat Reader versions 22.002.20212 (and earlier) and…7.8
• CVE-2022-4234A vulnerability was found in SourceCodester Canteen Manageme…6.1
• CVE-2022-42340Adobe ColdFusion versions Update 14 (and earlier) and Update…7.5