Cache Attributes Mismanagement in HVM Guests by Xen Project
CVE-2022-42333

8.6HIGH

Key Information:

Vendor

Xen Project
Status
Xen Project
Vendor
CVE Published:
21 March 2023

What is CVE-2022-42333?

This vulnerability relates to the improper handling of pinned cache attributes for HVM (Hardware Virtual Machine) guests. It allows controlled cacheability for guests with passthrough devices but can be exploited by less privileged entities, such as qemu instances running in Dom0 or a stub-domain. Due to the unbounded nature of controlled cache regions and the lack of proper serialization during installation and removal, potential risks arise that can compromise the stability and security of the affected systems.

Affected Version(s)

xen consult Xen advisory XSA-428

References

https://xenbits.xenproject.org/xsa/advisory-428.txt
http://xenbits.xen.org/xsa/advisory-428.html
http://www.openwall.com/lists/oss-security/2023/03/21/2
mailing-list

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'Aspects of this issue were discovered by Andrew Cooper of XenServer and\nJan Beulich of SUSE.'}]}}}
.
CVE-2022-42333 : Cache Attributes Mismanagement in HVM Guests by Xen Project