CVE-2022-42334 Race condition in xen
A race condition in Xen's HVM pinned cache attributes handling allows a malicious domain controller to cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-42334?
CVE-2022-42334 is a medium-severity vulnerability in Debian Debian Linux, published on 21 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334).
Weakness: CWE-770
Which versions are affected by CVE-2022-42334?
It affects 3 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Xen Xen.
How do I fix CVE-2022-42334?
Apply the vendor's patch.
Is CVE-2022-42334 being exploited?
There is no known exploitation of CVE-2022-42334 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-42334, DEBIAN-CVE-2022-42334, GHSA-v57p-c5gg-pq5v, UBUNTU-CVE-2022-42334.