linux: Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text e...
CVE-2022-42328 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2022-42328, released December 7, 2022. It is not reported as exploited. Patch Radar priority: Routine.
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bpftool · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| bpftool-debuginfo · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-debuginfo · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-debuginfo-common-aarch64 · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-debuginfo-common-x86_64 · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-devel · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-headers · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-libbpf · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-libbpf-devel · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-libbpf-static · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-livepatch-6.1.10-15.42 · amzn 2023 | 1.0-0.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-tools · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-tools-debuginfo · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| kernel-tools-devel · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| linux · Debian 12.15 (bookworm) | 6.0.12-1 | DEBIAN-CVE-2022-42328 | Dec 7, 2022 |
| linux · Debian 13.5 (trixie) | 6.0.12-1 | DEBIAN-CVE-2022-42328 | Dec 7, 2022 |
| linux · Debian 14 | 6.0.12-1 | DEBIAN-CVE-2022-42328 | Dec 7, 2022 |
| perf · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| perf-debuginfo · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| python3-perf · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
| python3-perf-debuginfo · amzn 2023 | 6.1.10-15.42.amzn2023 | ALAS2023-2023-070 | Feb 17, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.