CVE-2022-46770

Deeper analysis

CVE-2022-46770 affects the qubes-mirage-firewall component (versions 0.8.x through 0.8.3) used in QubesOS. The flaw is an infinite-loop condition (CWE-835) triggered when the firewall processes a crafted multicast UDP packet whose destination address falls in the 224.0.0.0/4 range, resulting in sustained CPU consumption and cessation of all packet forwarding.

A guest OS user on a Qubes system can send the malicious UDP packet from within a network-connected VM. Because the packet is processed by the Mirage-based firewall running in a separate domain, the attacker needs no privileges outside the guest and can achieve a denial-of-service condition that disrupts network connectivity for other qubes without requiring user interaction.

Public references consist of a GitHub issue and an accompanying Packet Storm entry that demonstrate the packet construction; neither source describes an official patch or configuration workaround beyond upgrading to a corrected release of qubes-mirage-firewall.

The associated EPSS score rose from a low baseline to a recorded peak of 0.2456, indicating that exploitation interest increased after disclosure and that the vulnerability merits renewed attention.