CVE-2022-33749 Denial of service in Xapi
An unauthenticated network attacker can exhaust XAPI file descriptors, causing a denial of service for trusted clients and administrative tasks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-33749?
CVE-2022-33749 is a medium-severity denial of service vulnerability in Xapi, published on 11 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new requests for other (trusted) clients, and blocks XAPI from carrying out any tasks that require the opening of file descriptors.
Weakness: CWE-770
Which versions are affected by CVE-2022-33749?
It affects 1 product.
Products include Xen Xapi.
How do I fix CVE-2022-33749?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-33749 being exploited?
There is no known exploitation of CVE-2022-33749 in the wild and no public exploit code.
Other vulnerabilities in Xapi
Sources
Also known as ALPINE-CVE-2022-33749, GHSA-v88g-q782-jgp2.