CVE-2022-42333 Denial of service in xen

High 8.6 Published 21 Mar 2023 Updated 13 Feb 2025

A malicious domain controller can exhaust resources by creating unbounded pinned cache attribute regions, causing a denial of service in the Xen hypervisor.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-42333?

CVE-2022-42333 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 21 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334).

Weakness: CWE-770

Which versions are affected by CVE-2022-42333?

It affects 3 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Xen Xen.

How do I fix CVE-2022-42333?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-42333 being exploited?

There is no known exploitation of CVE-2022-42333 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2022-42333, DEBIAN-CVE-2022-42333, GHSA-vgj2-gwrp-65hq, UBUNTU-CVE-2022-42333.