CVE-2022-33746 Denial of service in xen
An attacker can cause a denial of service by triggering excessive delays during P2M pool freeing due to missing preemption checks in the Xen hypervisor.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-33746?
CVE-2022-33746 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 11 Oct 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks. Such checking for the need to preempt was so far missing.
Weakness: CWE-404
Which versions are affected by CVE-2022-33746?
It affects 3 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Xen Xen.
How do I fix CVE-2022-33746?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-33746 being exploited?
There is no known exploitation of CVE-2022-33746 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-33746, DEBIAN-CVE-2022-33746, GHSA-r55p-5rm2-vqg9, UBUNTU-CVE-2022-33746.