Use-after-free Vulnerability in Xen's x86 Shadow and Log-Dirty Mode
CVE-2022-42332

7.8HIGH

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
21 March 2023

What is CVE-2022-42332?

In certain environments where Hardware Assisted Paging (HAP) is not available, the Xen Hypervisor operates in shadow mode, which relies on a memory pool for shadow page tables and auxiliary structures. During migration or snapshot processes, it also utilizes log-dirty mode for memory allocation tracking. However, the Xen architecture fails to properly account for memory demands of the log-dirty infrastructure when establishing new shadow page tables. Consequently, these tables may be prematurely freed while still being accessed by other operations, leading to potential memory corruption and instability.

Affected Version(s)

xen consult Xen advisory XSA-427

References

https://xenbits.xenproject.org/xsa/advisory-427.txt
http://xenbits.xen.org/xsa/advisory-427.html
http://www.openwall.com/lists/oss-security/2023/03/21/1
mailing-list

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Jan Beulich of SUSE.'}]}}}
.
CVE-2022-42332 : Use-after-free Vulnerability in Xen's x86 Shadow and Log-Dirty Mode