CVE-2022-42324

MEDIUM Year: 2022
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-681
View all →

Vulnerability Description

Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.

Related Vulnerabilities

CVE-2018-5711

MEDIUM
CVSS:5.5(Medium)

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an inf...

CWE-6812018

CVE-2020-27194

MEDIUM
CVSS:5.5(Medium)

An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a.

CWE-6812020

CVE-2021-29539

MEDIUM
CVSS:5.5(Medium)

TensorFlow is an end-to-end open source platform for machine learning. Calling `tf.raw_ops.ImmutableConst`(https://www.tensorflow.org/api_docs/python/tf/raw_ops/ImmutableConst) with a `dtype` of `tf.r...

CWE-6812021

CVE-2021-37645

MEDIUM
CVSS:5.5(Medium)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` is vulnerable to an integer overflow issue ca...

CWE-6812021

CVE-2021-37646

MEDIUM
CVSS:5.5(Medium)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.StringNGrams` is vulnerable to an integer overflow issue caused by convert...

CWE-6812021

CVE-2021-37661

MEDIUM
CVSS:5.5(Medium)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in `boosted_trees_create_quantile_stream_resource` by using negati...

CWE-6812021