CVE-2022-35414
📋 TL;DR
CVE-2022-35414 is an uninitialized read vulnerability in QEMU's memory management component that can lead to crashes when handling I/O operations. This affects QEMU versions through 7.0.0 when used in non-virtualization scenarios, though the vendor considers this a non-security bug for virtualization use cases.
💻 Affected Systems
- QEMU
📦 What is this software?
Qemu by Qemu
⚠️ Risk & Real-World Impact
Worst Case
Denial of service through QEMU process crash, potentially disrupting services or virtual machines managed by QEMU.
Likely Case
Application instability or crashes when QEMU encounters specific I/O operations on the translate_fail path.
If Mitigated
Minimal impact if QEMU is used only for virtualization purposes as intended by the vendor.
🎯 Exploit Status
Exploitation requires triggering the specific translate_fail path with uninitialized memory access. No known active exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 3517fb726741c109cae7995f9ea46f0cab6187d6 and later versions
Vendor Advisory: https://gitlab.com/qemu-project/qemu/-/issues/1169
Restart Required: Yes
Instructions:
1. Update QEMU to version 7.0.1 or later. 2. Apply the specific patch from commit 3517fb726741c109cae7995f9ea46f0cab6187d6 if using custom builds. 3. Restart all QEMU processes and virtual machines.
🔧 Temporary Workarounds
Limit QEMU to virtualization use only
allEnsure QEMU is only used for its intended virtualization purposes, not for non-virtualization use cases where this vulnerability is considered more critical.
🧯 If You Can't Patch
- Isolate QEMU instances from untrusted networks and users
- Monitor QEMU processes for crashes and implement restart automation
🔍 How to Verify
Check if Vulnerable:
Check QEMU version with 'qemu-system-x86_64 --version' or similar architecture command. Versions 7.0.0 and earlier are vulnerable.Check Version:
qemu-system-x86_64 --version | grep -E 'version|QEMU'Verify Fix Applied:
Verify version is 7.0.1 or later, or check that commit 3517fb726741c109cae7995f9ea46f0cab6187d6 is included in the build.📡 Detection & Monitoring
Log Indicators:
- QEMU process crashes
- Segmentation fault errors in system logs
- Unexpected termination of virtual machines
Network Indicators:
- Unusual I/O patterns to QEMU-managed devices
SIEM Query:
source="system" AND ("qemu" OR "kvm") AND ("segmentation fault" OR "crash" OR "SIGSEGV")🔗 References
- https://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.c
- https://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148
- https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482
- https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aa
- https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c
- https://gitlab.com/qemu-project/qemu/-/issues/1065
- https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
- https://sick.codes/sick-2022-113
- https://www.mail-archive.com/qemu-devel%40nongnu.org/msg895266.html
- https://www.qemu.org/docs/master/system/security.html#non-virtualization-use-case
- https://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.c
- https://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148
- https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482
- https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aa
- https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c
- https://gitlab.com/qemu-project/qemu/-/issues/1065
- https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
- https://sick.codes/sick-2022-113
- https://www.mail-archive.com/qemu-devel%40nongnu.org/msg895266.html
- https://www.qemu.org/docs/master/system/security.html#non-virtualization-use-case
