PT-2023-14102 · Xen+1 · Xen+1

Jan Beulich · Published 2023-03-21 · Updated 2024-06-15 · CVE-2022-42332

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xen (affected versions not specified)

Description The issue arises in environments where host-assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, causing Xen to run guests in shadow mode. Shadow mode maintains a pool of memory for shadow page tables and auxiliary data structures. When migrating or snapshotting guests, Xen also runs them in log-dirty mode, which requires additional data structures. However, the demands of the log-dirty infrastructure were not considered, leading to a situation where newly established shadow page tables could be freed immediately, while other code is still accessing them. This results in a use-after-free scenario.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2022-42332

DSA-5378-1

OPENSUSE-SU-2024:12833-1

SUSE-SU-2023:0845-1

SUSE-SU-2023:0846-1

SUSE-SU-2023:0847-1

SUSE-SU-2023:0848-1

SUSE-SU-2023:0848-2

SUSE-SU-2023:0858-1

SUSE-SU-2023:0859-1

SUSE-SU-2023:0862-1

Affected Products

Suse

Xen

References · 48

• https://osv.dev/vulnerability/SUSE-SU-2023:0845-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0847-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5378 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-427.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-42332 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-42332 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5L6PM4RE7MUE6OWA32ZVOXCP235RM2TM · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0859-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APBMS2Q6746AXAFAITNJMGBNFGNMVLWR · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42332 · Vendor Advisory
• https://xenbits.xenproject.org/xsa/advisory-427.txt · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0862-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0848-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-42332 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5378-1 · Vendor Advisory