PatchTheCVExhyve vulnerabilities and fixes
Recent CVEs affecting xhyve, with upgrade or downgrade steps. 4 tracked.
xhyve has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-09-07. Highest priority: CVE-2022-36660 (score 60/100).
- CVE-2022-36661 MEDIUM 6.5 DOWNGRADE xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_read()
- CVE-2022-36660 CRITICAL 9.8 DOWNGRADE xhyve commit dfbe09b was discovered to contain a stack buffer overflow via the component pci_vtrnd_notify().
- CVE-2022-36659 MEDIUM 6.5 DOWNGRADE xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_write()
- CVE-2022-35867 MEDIUM 6.7 DOWNGRADE This vulnerability allows local attackers to escalate privileges on affected installations of xhyve
FAQ
How do I fix xhyve vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xhyve being exploited right now?
None of the tracked xhyve CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xhyve CVE should I patch first?
CVE-2022-36660 currently ranks highest (60/100): xhyve commit dfbe09b was discovered to contain a stack buffer overflow via the component pci_vtrnd_notify()..