PT-2022-17807 · Xen+1 · Xen+1
Roger Pau
+1
·
Published
2022-04-05
·
Updated
2024-06-15
·
CVE-2022-26356
CVSS v3.1
5.6
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions prior to 4.9
Description
The issue arises from racy interactions between dirty vram tracking and paging log dirty hypercalls. Activation of log dirty mode done by
XEN DMOP track dirty vram (previously named HVMOP track dirty vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN DMOP track dirty vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a previously enabled log dirty mode (XEN DOMCTL SHADOW OP OFF). This is due to the lack of mutually exclusive locking between both operations and can lead to entries being added in already freed slots, resulting in a memory leak.Recommendations
As a temporary workaround, consider disabling the
XEN DMOP track dirty vram function until a patch is available. Restrict access to the log dirty mode to minimize the risk of exploitation. Avoid using the XEN DOMCTL SHADOW OP OFF operation in conjunction with XEN DMOP track dirty vram until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Xen