Incorrect authorization in Xen - CVE-2022-23033

Vulnerability identifier: #VU63797

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23033

CWE-ID: CWE-863

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to guest_physmap_remove_page() function does not remove p2m mappings. A local user issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, can cause information leaks, Denial of Service (DoS), or escalate privileges on the system.

Xen
Debian Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
Fedora
xen
xen-debugsource
xen-devel
xen-doc-html
xen-libs-32bit
xen-libs
xen-libs-debuginfo-32bit
xen-libs-debuginfo
xen-tools
xen-tools-debuginfo
xen-tools-domU
xen-tools-domU-debuginfo
xen-tools-xendomains-wait-disk
xen (Debian package)

Install updates from vendor's website.

Xen - update to 4.14.4
xen - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-debugsource - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-devel - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-doc-html - update to 4.12.4_18-3.58.2
xen-libs-32bit - update to 4.12.4_18-3.58.2
xen-libs - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-libs-debuginfo-32bit - update to 4.12.4_18-3.58.2
xen-libs-debuginfo - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-tools - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-tools-debuginfo - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-tools-domU - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-tools-domU-debuginfo - addressed in versions 4.12.4_18-3.58.2, 4.12.4_18-3.60.2, 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen-tools-xendomains-wait-disk - addressed in versions 4.13.4_04-3.43.2, 4.14.3_06-150300.3.18.2
xen - addressed in versions 4.14.3-4.fc34, 4.14.4-1.fc34, 4.15.1-5.fc35
xen (Debian package) - update to 4.14.4+74-gd7b22226b5-1

• https://xenbits.xenproject.org/xsa/advisory-393.txt
• http://www.openwall.com/lists/oss-security/2022/01/25/2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3/
• https://www.debian.org/security/2022/dsa-5117

• Debian update for xen
• SUSE update for xen
• SUSE update for xen
• SUSE update for xen
• SUSE update for xen
• Fedora 35 update for xen
• Fedora 34 update for xen
• Fedora 34 update for xen