Insufficient TLB Flush in Xen for x86 PV Guests in Shadow Mode
CVE-2022-33745

8.8HIGH

Key Information:

Vendor

Xen Project
Status
Xen
Vendor
CVE Published:
26 July 2022

What is CVE-2022-33745?

The vulnerability arises from an insufficient Translation Lookaside Buffer (TLB) flush condition for x86 ParaVirtualization (PV) guests operating in a shadow mode. This issue is triggered during guest migration and occurs due to the movement of code inside the Xen hypervisor, which inadvertently altered the meaning of a crucial variable. Consequently, the faulty usage of this variable fails to ensure necessary TLB flushes, potentially allowing unprivileged access to sensitive data through improper memory management in virtualized environments.

Affected Version(s)

xen consult Xen advisory XSA-408

References

https://xenbits.xenproject.org/xsa/advisory-408.txt
http://xenbits.xen.org/xsa/advisory-408.html
http://www.openwall.com/lists/oss-security/2022/07/26/2
mailing-list

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Charles Arnold of SUSE.'}]}}}
.
CVE-2022-33745 : Insufficient TLB Flush in Xen for x86 PV Guests in Shadow Mode