Resource management error in Xen - CVE-2022-33744

Vulnerability identifier: #VU65844

CSH Severity: Low

CVSS v4: 8.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H]

CVE-ID: CVE-2022-33744

CWE-ID: CWE-399

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of foreign mappings performed by rbtree when mapping pages of Arm guests. An unprivileged Arm guest can cause inconsistencies of the rbtree via PV devices, which can lead to denial of service of dom0 and cause crashes or the inability to perform further mappings of other guests' memory pages.

Xen
Amazon Linux AMI
Anolis OS
Ubuntu
Slackware Linux
openEuler
linux-image-4.15.0-1142-aws-hwe (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-4.15.0-1153-azure (Ubuntu package)
linux-image-4.15.0-1137-gcp (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-4.15.0-1107-oracle (Ubuntu package)
linux-image-oem (Ubuntu package)
linux-image-4.15.0-194-lowlatency (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-4.15.0-194-generic (Ubuntu package)
kernel
linux-image-virtual (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-4.15.0-194-generic-lpae (Ubuntu package)
linux-image-dell300x (Ubuntu package)
linux-image-4.15.0-1054-dell300x (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.15.0-1120-raspi2 (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.15.0-1128-kvm (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.15.0-1138-snapdragon (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-4.15.0-1142-aws (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
python2-perf-debuginfo
bpftool-debuginfo
kernel-debugsource
python3-perf-debuginfo
perf
kernel-devel
kernel-tools-debuginfo
kernel-debuginfo
kernel-tools
python2-perf
perf-debuginfo
kernel-tools-devel
bpftool
kernel-source
python3-perf
kernel-debug
kernel-tools-libs-devel
kernel-tools-libs
kernel-modules-internal
kernel-modules-extra
kernel-modules
kernel-headers
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-devel
python-perf
kernel-core
kernel-debug-core
linux-image-oem-osp1 (Ubuntu package)
linux-image-5.4.0-128-generic-lpae (Ubuntu package)
linux-image-5.4.0-128-lowlatency (Ubuntu package)
linux-image-5.4.0-128-generic (Ubuntu package)
linux-image-lowlatency-hwe-18.04 (Ubuntu package)
linux-image-generic-hwe-18.04 (Ubuntu package)
linux-image-virtual-hwe-18.04 (Ubuntu package)
linux-image-generic-lpae-hwe-18.04 (Ubuntu package)
linux-image-snapdragon-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1034-ibm (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-ibm-lts-20.04 (Ubuntu package)
linux-image-bluefield (Ubuntu package)
linux-image-5.4.0-1047-bluefield (Ubuntu package)
linux-image-gkeop (Ubuntu package)
linux-image-gkeop-5.4 (Ubuntu package)
linux-image-5.4.0-1054-gkeop (Ubuntu package)
linux-image-raspi-hwe-18.04 (Ubuntu package)
linux-image-5.4.0-1071-raspi (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-5.4.0-1076-kvm (Ubuntu package)
linux-image-oracle-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1084-gke (Ubuntu package)
linux-image-5.4.0-1084-oracle (Ubuntu package)
linux-image-gke-5.4 (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-aws-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1086-aws (Ubuntu package)
linux-image-gcp-lts-20.04 (Ubuntu package)
linux-image-5.4.0-1090-gcp (Ubuntu package)
linux-image-5.4.0-1092-azure-fde (Ubuntu package)
linux-image-azure-fde (Ubuntu package)
linux (Debian package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-lowlatency-hwe-22.04 (Ubuntu package)
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package)
linux-image-oem-20.04 (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic-hwe-22.04 (Ubuntu package)
linux-image-virtual-hwe-22.04 (Ubuntu package)
linux-image-generic-lpae-hwe-22.04 (Ubuntu package)
linux-image-generic-64k-hwe-22.04 (Ubuntu package)
linux-image-5.15.0-48-generic-lpae (Ubuntu package)
linux-image-5.15.0-48-generic-64k (Ubuntu package)
linux-image-5.15.0-48-generic (Ubuntu package)
linux-image-5.15.0-48-lowlatency (Ubuntu package)
linux-image-5.15.0-48-lowlatency-64k (Ubuntu package)
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package)
linux-image-lowlatency-hwe-20.04 (Ubuntu package)
linux-image-generic-64k-hwe-20.04 (Ubuntu package)
linux-image-generic-lpae-hwe-20.04 (Ubuntu package)
linux-image-generic-hwe-20.04 (Ubuntu package)
linux-image-virtual-hwe-20.04 (Ubuntu package)
linux-image-gkeop-5.15 (Ubuntu package)
linux-image-5.15.0-1003-gkeop (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-5.15.0-1015-ibm (Ubuntu package)
linux-image-5.15.0-1015-raspi (Ubuntu package)
linux-image-5.15.0-1015-raspi-nolpae (Ubuntu package)
linux-image-gke-5.15 (Ubuntu package)
linux-image-5.15.0-1016-gke (Ubuntu package)
linux-image-5.15.0-1016-intel-iotg (Ubuntu package)
linux-image-5.15.0-1018-kvm (Ubuntu package)
linux-image-5.15.0-1018-oracle (Ubuntu package)
linux-image-5.15.0-1018-gcp (Ubuntu package)
linux-image-5.15.0-1020-aws (Ubuntu package)
linux-image-5.15.0-1020-azure (Ubuntu package)
linux-5.15.63/kernel-modules
linux-5.15.63/kernel-huge
linux-5.15.63/kernel-headers
linux-5.15.63/kernel-generic
linux-image-intel-iotg (Ubuntu package)
RecoverPoint for VMs

Install updates from vendor's website.

linux-image-4.15.0-1142-aws-hwe (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-aws-hwe (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-azure (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.15.0.1020.19, 5.15.0.1020.25~20.04.13
linux-image-4.15.0-1153-azure (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-1153.168
linux-image-4.15.0-1137-gcp (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-1137.153
linux-image-gke (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.4.0.1084.92, 5.15.0.1016.18
linux-image-gcp (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.15.0.1018.16, 5.15.0.1018.24~20.04.1
linux-image-generic-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.15.0-1107-oracle (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-1107.118
linux-image-oem (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.4.0.128.129, 5.4.0.128.144~18.04.107
linux-image-4.15.0-194-lowlatency (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-194.205
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-oracle (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 5.4.0.1084.92~18.04.61, 5.15.0.1018.16
linux-image-4.15.0-194-generic (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 4.15.0-194.205
kernel - update to 4.14.287-148.504
linux-image-virtual (Ubuntu package) - addressed in versions 4.15.0.194.179, 5.4.0.128.129, 5.15.0.48.48
linux-image-generic (Ubuntu package) - addressed in versions 4.15.0.194.179, 5.4.0.128.129, 5.15.0.48.48
linux-image-generic-lpae (Ubuntu package) - addressed in versions 4.15.0.194.179, 5.4.0.128.129, 5.15.0.48.48
linux-image-lowlatency (Ubuntu package) - addressed in versions 4.15.0.194.179, 5.4.0.128.129, 5.15.0.48.45
linux-image-4.15.0-194-generic-lpae (Ubuntu package) - update to 4.15.0-194.205
linux-image-dell300x (Ubuntu package) - update to 4.15.0.1054.54
linux-image-4.15.0-1054-dell300x (Ubuntu package) - update to 4.15.0-1054.59
linux-image-oracle-lts-18.04 (Ubuntu package) - update to 4.15.0.1107.114
linux-image-raspi2 (Ubuntu package) - addressed in versions 4.15.0.1120.117, 5.4.0.1071.104
linux-image-4.15.0-1120-raspi2 (Ubuntu package) - update to 4.15.0-1120.128
linux-image-kvm (Ubuntu package) - addressed in versions 4.15.0.1128.121, 5.4.0.1076.73, 5.15.0.1018.16
linux-image-4.15.0-1128-kvm (Ubuntu package) - update to 4.15.0-1128.133
linux-image-gcp-lts-18.04 (Ubuntu package) - update to 4.15.0.1137.153
linux-image-snapdragon (Ubuntu package) - update to 4.15.0.1138.139
linux-image-4.15.0-1138-snapdragon (Ubuntu package) - update to 4.15.0-1138.148
linux-image-aws-lts-18.04 (Ubuntu package) - update to 4.15.0.1142.142
linux-image-4.15.0-1142-aws (Ubuntu package) - update to 4.15.0-1142.154
linux-image-azure-lts-18.04 (Ubuntu package) - update to 4.15.0.1153.123
python2-perf-debuginfo - update to 4.19.90-2207.3.0.0159
bpftool-debuginfo - update to 4.19.90-2207.3.0.0159
kernel-debugsource - update to 4.19.90-2207.3.0.0159
kernel - update to 4.19.90-2207.3.0.0159
python3-perf-debuginfo - update to 4.19.90-2207.3.0.0159
perf - update to 4.19.90-2207.3.0.0159
kernel-devel - update to 4.19.90-2207.3.0.0159
kernel-tools-debuginfo - update to 4.19.90-2207.3.0.0159
kernel-debuginfo - update to 4.19.90-2207.3.0.0159
kernel-tools - update to 4.19.90-2207.3.0.0159
python2-perf - update to 4.19.90-2207.3.0.0159
perf-debuginfo - update to 4.19.90-2207.3.0.0159
kernel-tools-devel - update to 4.19.90-2207.3.0.0159
bpftool - update to 4.19.90-2207.3.0.0159
kernel-source - update to 4.19.90-2207.3.0.0159
python3-perf - update to 4.19.90-2207.3.0.0159
kernel-devel - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
bpftool - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-debug - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
python3-perf - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
perf - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-tools-libs-devel - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-tools-libs - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-tools - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-modules-internal - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-modules-extra - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-modules - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-headers - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-debug-modules-extra - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-debug-modules - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-debug-devel - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
python-perf - addressed in versions 4.19.91-27.1, 4.19.91-28
kernel-core - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
kernel-debug-core - addressed in versions 4.19.91-27.1, 4.19.91-28, 5.10.134-12
linux-image-oem-osp1 (Ubuntu package) - addressed in versions 5.4.0.128.129, 5.4.0.128.144~18.04.107
linux-image-5.4.0-128-generic-lpae (Ubuntu package) - update to 5.4.0-128.144~18.04.1
linux-image-5.4.0-128-lowlatency (Ubuntu package) - update to 5.4.0-128.144~18.04.1
linux-image-5.4.0-128-generic (Ubuntu package) - update to 5.4.0-128.144~18.04.1
linux-image-lowlatency-hwe-18.04 (Ubuntu package) - update to 5.4.0.128.144~18.04.107
linux-image-generic-hwe-18.04 (Ubuntu package) - update to 5.4.0.128.144~18.04.107
linux-image-virtual-hwe-18.04 (Ubuntu package) - update to 5.4.0.128.144~18.04.107
linux-image-generic-lpae-hwe-18.04 (Ubuntu package) - update to 5.4.0.128.144~18.04.107
linux-image-snapdragon-hwe-18.04 (Ubuntu package) - update to 5.4.0.128.144~18.04.107
linux-image-5.4.0-1034-ibm (Ubuntu package) - update to 5.4.0-1034.38~18.04.1
linux-image-ibm (Ubuntu package) - addressed in versions 5.4.0.1034.48, 5.4.0.1034.63, 5.15.0.1015.14
linux-image-ibm-lts-20.04 (Ubuntu package) - update to 5.4.0.1034.63
linux-image-bluefield (Ubuntu package) - update to 5.4.0.1047.46
linux-image-5.4.0-1047-bluefield (Ubuntu package) - update to 5.4.0-1047.52
linux-image-gkeop (Ubuntu package) - addressed in versions 5.4.0.1054.55, 5.15.0.1003.5
linux-image-gkeop-5.4 (Ubuntu package) - update to 5.4.0.1054.55
linux-image-5.4.0-1054-gkeop (Ubuntu package) - update to 5.4.0-1054.57
linux-image-raspi-hwe-18.04 (Ubuntu package) - update to 5.4.0.1071.71
linux-image-5.4.0-1071-raspi (Ubuntu package) - update to 5.4.0-1071.81~18.04.1
linux-image-raspi (Ubuntu package) - addressed in versions 5.4.0.1071.104, 5.15.0.1015.14
linux-image-5.4.0-1076-kvm (Ubuntu package) - update to 5.4.0-1076.81
linux-image-oracle-lts-20.04 (Ubuntu package) - update to 5.4.0.1084.81
linux-image-5.4.0-1084-gke (Ubuntu package) - update to 5.4.0-1084.90
linux-image-5.4.0-1084-oracle (Ubuntu package) - addressed in versions 5.4.0-1084.92, 5.4.0-1084.92~18.04.1
linux-image-gke-5.4 (Ubuntu package) - update to 5.4.0.1084.92
linux-image-aws (Ubuntu package) - addressed in versions 5.4.0.1086.66, 5.15.0.1020.20, 5.15.0.1020.24~20.04.12
linux-image-aws-lts-20.04 (Ubuntu package) - update to 5.4.0.1086.86
linux-image-5.4.0-1086-aws (Ubuntu package) - addressed in versions 5.4.0-1086.93, 5.4.0-1086.93~18.04.1
linux-image-gcp-lts-20.04 (Ubuntu package) - update to 5.4.0.1090.95
linux-image-5.4.0-1090-gcp (Ubuntu package) - update to 5.4.0-1090.98
linux-image-5.4.0-1092-azure-fde (Ubuntu package) - update to 5.4.0-1092.97+cvm1.1
linux-image-azure-fde (Ubuntu package) - update to 5.4.0.1092.97+cvm1.32
linux (Debian package) - update to 5.10.127-2
linux-image-lowlatency-64k (Ubuntu package) - update to 5.15.0.48.45
linux-image-lowlatency-hwe-22.04 (Ubuntu package) - update to 5.15.0.48.45
linux-image-lowlatency-64k-hwe-22.04 (Ubuntu package) - update to 5.15.0.48.45
linux-image-oem-20.04 (Ubuntu package) - update to 5.15.0.48.48
linux-image-generic-64k (Ubuntu package) - update to 5.15.0.48.48
linux-image-generic-hwe-22.04 (Ubuntu package) - update to 5.15.0.48.48
linux-image-virtual-hwe-22.04 (Ubuntu package) - update to 5.15.0.48.48
linux-image-generic-lpae-hwe-22.04 (Ubuntu package) - update to 5.15.0.48.48
linux-image-generic-64k-hwe-22.04 (Ubuntu package) - update to 5.15.0.48.48
linux-image-5.15.0-48-generic-lpae (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-5.15.0-48-generic-64k (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-5.15.0-48-generic (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-5.15.0-48-lowlatency (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-5.15.0-48-lowlatency-64k (Ubuntu package) - update to 5.15.0-48.54~20.04.1
linux-image-lowlatency-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.16
linux-image-lowlatency-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.16
linux-image-generic-64k-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.18
linux-image-generic-lpae-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.18
linux-image-generic-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.18
linux-image-virtual-hwe-20.04 (Ubuntu package) - update to 5.15.0.48.54~20.04.18
linux-image-gkeop-5.15 (Ubuntu package) - update to 5.15.0.1003.5
linux-image-5.15.0-1003-gkeop (Ubuntu package) - update to 5.15.0-1003.5
linux-image-raspi-nolpae (Ubuntu package) - update to 5.15.0.1015.14
linux-image-5.15.0-1015-ibm (Ubuntu package) - update to 5.15.0-1015.17
linux-image-5.15.0-1015-raspi (Ubuntu package) - update to 5.15.0-1015.17
linux-image-5.15.0-1015-raspi-nolpae (Ubuntu package) - update to 5.15.0-1015.17
linux-image-intel-iotg (Ubuntu package) - update to 5.15.0.1016.17
linux-image-gke-5.15 (Ubuntu package) - addressed in versions 5.15.0.1016.18, 5.15.0.1016.19~20.04.1
linux-image-5.15.0-1016-gke (Ubuntu package) - addressed in versions 5.15.0-1016.19, 5.15.0-1016.19~20.04.1
linux-image-5.15.0-1016-intel-iotg (Ubuntu package) - update to 5.15.0-1016.21
linux-image-5.15.0-1018-kvm (Ubuntu package) - update to 5.15.0-1018.22
linux-image-5.15.0-1018-oracle (Ubuntu package) - update to 5.15.0-1018.23
linux-image-5.15.0-1018-gcp (Ubuntu package) - addressed in versions 5.15.0-1018.24, 5.15.0-1018.24~20.04.1
linux-image-5.15.0-1020-aws (Ubuntu package) - addressed in versions 5.15.0-1020.24, 5.15.0-1020.24~20.04.1
linux-image-5.15.0-1020-azure (Ubuntu package) - addressed in versions 5.15.0-1020.25, 5.15.0-1020.25~20.04.1
linux-5.15.63/kernel-modules - update to 5.15.63
linux-5.15.63/kernel-huge - update to 5.15.63
linux-5.15.63/kernel-headers - update to 5.15.63
linux-5.15.63/kernel-generic - update to 5.15.63
RecoverPoint for VMs - update to 6.0.SP1.P1

• https://xenbits.xenproject.org/xsa/advisory-406.txt
• http://xenbits.xen.org/xsa/advisory-406.html
• http://www.openwall.com/lists/oss-security/2022/07/05/4
• https://www.debian.org/security/2022/dsa-5191

• Denial of service in Xen
• Debian update for linux
• Amazon Linux AMI update for kernel
• Slackware Linux update for kernel
• Ubuntu update for linux-hwe-5.15
• Ubuntu update for linux
• Ubuntu update for linux-gcp
• Ubuntu update for linux-gkeop
• Ubuntu update for linux-oracle
• Ubuntu update for linux-gcp-5.15
• Ubuntu update for linux-gke-5.15
• Ubuntu update for linux-intel-iotg
• Ubuntu update for linux-hwe
• Ubuntu update for linux
• Ubuntu update for linux
• Ubuntu update for linux-aws-hwe
• Ubuntu update for linux-aws
• Ubuntu update for linux-gcp
• Ubuntu update for linux-ibm
• Ubuntu update for linux-aws-5.4
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-4.15
• Ubuntu update for linux-gcp
• Ubuntu update for linux-azure-fde
• openEuler update for kernel
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Anolis OS update for kernel
• Anolis OS update for kernel(ANCK)4.19
• Anolis OS update for kernel
• Anolis OS update for kernel
• Anolis OS update for kernel