5.6

CVE-2022-33748

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU.

Data is provided by the National Vulnerability Database (NVD)
Xen ≫ Xen Version >= 4.0
Fedoraproject ≫ Fedora Version35
Fedoraproject ≫ Fedora Version36
Fedoraproject ≫ Fedora Version37
Debian ≫ Debian Linux Version11.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.064
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.6 1.1 4
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
CWE-755 Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

http://www.openwall.com/lists/oss-security/2022/10/11/2
Patch
Third Party Advisory
Mailing List
Mitigation
http://xenbits.xen.org/xsa/advisory-411.html
Patch
Vendor Advisory
Mitigation
https://xenbits.xenproject.org/xsa/advisory-411.txt
Patch
Vendor Advisory
Mitigation