CVE-2022-33744
Summary
| CVE | CVE-2022-33744 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-07-05 13:15:00 UTC |
| Updated | 2022-10-29 02:50:00 UTC |
| Description | Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged guests via PV devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS) of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory pages. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Operating System | Linux | Linux Kernel | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| XSA-406 - Xen Security Advisories | CONFIRM | xenbits.xen.org | |
| oss-security - Xen Security Advisory 406 v3 (CVE-2022-33744) - Arm guests can cause Dom0 DoS via PV devices | MLIST | www.openwall.com | |
| [SECURITY] [DLA 3131-1] linux security update | MLIST | lists.debian.org | |
| Debian -- Security Information -- DSA-5191-1 linux | DEBIAN | www.debian.org | |
| xenbits.xenproject.org/xsa/advisory-406.txt | MISC | xenbits.xenproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Array
Legacy QID Mappings
- 180900 Debian Security Update for linux (DSA 5191-1)
- 181091 Debian Security Update for linux (DLA 3131-1)
- 183821 Debian Security Update for linux (CVE-2022-33744)
- 198948 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5624-1)
- 198950 Ubuntu Security Notification for Linux kernel (HWE) Vulnerabilities (USN-5623-1)
- 198953 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5633-1)
- 198958 Ubuntu Security Notification for Linux kernel (GKE) Vulnerabilities (USN-5635-1)
- 198960 Ubuntu Security Notification for Linux kernel (Oracle) Vulnerabilities (USN-5640-1)
- 198964 Ubuntu Security Notification for Linux kernel (GCP) Vulnerabilities (USN-5644-1)
- 198967 Ubuntu Security Notification for Linux kernel (GKE) Vulnerabilities (USN-5648-1)
- 198972 Ubuntu Security Notification for Linux kernel (Intel IoTG) Vulnerabilities (USN-5655-1)
- 198978 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5669-1)
- 198980 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5668-1)
- 198985 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5678-1)
- 198987 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5677-1)
- 198989 Ubuntu Security Notification for Linux kernel (IBM) Vulnerabilities (USN-5683-1)
- 198990 Ubuntu Security Notification for Linux kernel (AWS) Vulnerabilities (USN-5682-1)
- 198994 Ubuntu Security Notification for Linux kernel (Azure) Vulnerabilities (USN-5687-1)
- 199011 Ubuntu Security Notification for Linux kernel (Azure CVM) Vulnerabilities (USN-5706-1)
- 354002 Amazon Linux Security Advisory for kernel : ALAS2-2022-1825
- 354016 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.10-2022-018
- 354025 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2022-033
- 354030 Amazon Linux Security Advisory for kernel : ALAS-2022-1624
- 377117 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX3-SA-2022:0158)
- 378043 Alibaba Cloud Linux Security Update for cloud-kernel (ALINUX2-SA-2023:0011)
- 502600 Alpine Linux Security Update for xen
- 503695 Alpine Linux Security Update for xen
- 6140072 AWS Bottlerocket Security Update for kernel (GHSA-vvf7-ccjw-7682)
- 672139 EulerOS Security Update for kernel (EulerOS-SA-2022-2428)
- 672158 EulerOS Security Update for kernel (EulerOS-SA-2022-2415)
- 902475 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10133)
- 902508 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10130)
- 904137 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10108-1)
- 904197 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10121-1)
- 905849 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10121-2)
- 906413 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (10108-2)