Race condition in Xen - CVE-2022-26357

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63438

Race condition in Xen - CVE-2022-26357

Published: May 19, 2022 / Updated: May 19, 2022


Vulnerability identifier: #VU63438
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-26357
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the VT-d domain ID cleanup. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.


Affected software

Xen
Debian Linux
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
Fedora
xen
xen-debugsource
xen-doc-html
xen-tools-domU-debuginfo
xen-tools-domU
xen-tools-debuginfo
xen-tools
xen-libs-debuginfo
xen-libs-debuginfo-32bit
xen-libs
xen-libs-32bit
xen-devel
xen-tools-xendomains-wait-disk
xen-libs-32bit-debuginfo
xen (Debian package)

How to mitigate CVE-2022-26357

Install updates from vendor's website.

Xen - update to 4.16.1
xen - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-debugsource - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-doc-html - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.12.4_22-3.66.1, 4.14.4_04-150300.3.24.1
xen-tools-domU-debuginfo - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-tools-domU - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-tools-debuginfo - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-tools - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-libs-debuginfo - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-libs-debuginfo-32bit - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.12.4_22-3.66.1
xen-libs - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-libs-32bit - addressed in versions 4.7.6_22-43.88.1, 4.9.4_28-3.103.1, 4.12.4_22-3.66.1, 4.14.4_04-150300.3.24.1
xen-devel - addressed in versions 4.10.4_34-150000.3.74.1, 4.12.4_22-3.66.1, 4.12.4_24-150100.3.72.1, 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen-tools-xendomains-wait-disk - addressed in versions 4.13.4_08-150200.3.50.1, 4.14.4_04-150300.3.24.1
xen - addressed in versions 4.14.4-3.fc34, 4.14.5-1.fc34, 4.15.2-3.fc35, 4.16.0-6.fc36, 4.16.1-1.fc36
xen-libs-32bit-debuginfo - update to 4.14.4_04-150300.3.24.1
xen (Debian package) - update to 4.14.4+74-gd7b22226b5-1

External References

Related Security Bulletins