Security readout for executives and security teams
Plain-English summary
This CVE describes a critical stack buffer overflow in xhyve’s pci_vtrnd_notify() component. The public record rates it 9.8, meaning potential full confidentiality, integrity, and availability impact. However, the source bundle does not identify affected versions, packaged products, a patch, or real-world exploitation.
Executive priority
Prioritize investigation because the potential impact is critical, but base emergency response on confirmed xhyve exposure. The main business risk is unrecognized use of vulnerable hypervisor code in development, virtualization, or embedded workflows.
Technical view
CVE-2022-36660 is recorded as CWE-787, an out-of-bounds write, in xhyve commit dfbe09b. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Public metadata lacks CPEs and product/version ranges, so exposure must be established through manual inventory.
Likely exposure
Likely exposure is limited to environments using xhyve code matching or derived from commit dfbe09b. The bundle lists vendor, product, versions, and CPEs as n/a, so automated scanner coverage may be incomplete or noisy.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. The CVSS vector indicates low-complexity, unauthenticated, no-user-interaction conditions, but the public evidence here does not describe exploit maturity or operational preconditions.
Researcher notes
The key gap is attribution: public metadata names xhyve and a commit, but not affected releases, CPEs, patches, or exploitation evidence. Researchers should focus on provenance, commit lineage, and whether downstream projects vendor or fork the vulnerable code.
Mitigation direction
- Identify all direct and embedded uses of xhyve in the environment.
- Check upstream or vendor guidance for fixed builds or recommended mitigations.
- Prioritize replacement or removal of confirmed vulnerable xhyve builds.
- Treat scanner-only matches cautiously because no CPEs are provided.
Validation and detection
- Inventory systems, build manifests, and dependencies for xhyve usage.
- Determine whether any deployed build matches or descends from commit dfbe09b.
- Review vendor advisories or repository history for a fix reference.
- Confirm whether compensating controls cover systems running confirmed affected code.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-36660 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://awxylitol.github.io/2022/07/21/disclose-three-bugs-in-xhyve.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.