HOME VULNERABILITIESCVE-2022-35414

HIGH

CVE-2022-35414

CWE-908Published: July 11, 2022· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Technical Analysis

CVE-2022-35414 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeChanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Vendors & Products

Debian1 product(s)

debian linux

qemu1 product(s)

qemu

Source: NVD CPE · 2 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.c

PATCHhttps://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482

PATCHhttps://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aa

PATCHhttps://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c

PATCHhttps://gitlab.com/qemu-project/qemu/-/issues/1065

PATCHhttps://sick.codes/sick-2022-113

PATCHhttps://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.c

PATCHhttps://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482

PATCHhttps://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aa

PATCHhttps://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c

PATCHhttps://gitlab.com/qemu-project/qemu/-/issues/1065

PATCHhttps://sick.codes/sick-2022-113

ADVISORYhttps://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148

ADVISORYhttps://lists.debian.org/debian-lts-announce/2022/09/msg00008.html

ADVISORYhttps://www.qemu.org/docs/master/system/security.html#non-virtualization-use-case

ADVISORYhttps://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148

ADVISORYhttps://lists.debian.org/debian-lts-announce/2022/09/msg00008.html

ADVISORYhttps://www.qemu.org/docs/master/system/security.html#non-virtualization-use-case

All References (20)

→

https://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.cPatch · Third Party Advisory

→

https://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148Release Notes · Third Party Advisory

→

https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482Patch · Third Party Advisory

→

https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aaPatch · Third Party Advisory

→

https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4cPatch · Third Party Advisory

→

https://gitlab.com/qemu-project/qemu/-/issues/1065Issue Tracking · Mitigation · Patch · Third Party Advisory

→

https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List · Third Party Advisory

→

https://sick.codes/sick-2022-113Exploit · Patch · Third Party Advisory

→

https://www.mail-archive.com/qemu-devel%40nongnu.org/msg895266.html

→

https://www.qemu.org/docs/master/system/security.html#non-virtualization-use-caseVendor Advisory

→

https://github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.cPatch · Third Party Advisory

→

https://github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.h#L145-L148Release Notes · Third Party Advisory

→

https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482Patch · Third Party Advisory

→

https://github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6#diff-83c563ed6330dc5d49876f1116e7518b5c16654bbc6e9b4ea8e28f5833d576fcR482.aaPatch · Third Party Advisory

→

https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4cPatch · Third Party Advisory

Quick Facts

CVE IDCVE-2022-35414

CVSS Score8.8 / 10

SeverityHIGH

WeaknessCWE-908

CISA KEVNo

Affected2 vendor(s)

PublishedJul 11, 2022

Related CVEs (CWE-908)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2022-35414 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2022-35414·NVD