Log in Start free

Vulnerability · Published Jan 25, 2022 · Assigned by XEN

CVE-2022-23034

Medium 5.5

In plain English

A medium-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 72.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference count for such a mapping would then mistakenly be decremented twice. Underflow of the counters gets detected, resulting in the triggering of a hypervisor bug check.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xen4.16.1-r0ALPINE-CVE-2022-23034
Alpine:v3.21xen4.16.1-r0ALPINE-CVE-2022-23034
Alpine:v3.22xen4.16.1-r0ALPINE-CVE-2022-23034
Alpine:v3.23xen4.16.1-r0ALPINE-CVE-2022-23034
Alpine:v3.24xen4.16.1-r0ALPINE-CVE-2022-23034
Debian:12xen4.16.0+51-g0941d6cb-1DEBIAN-CVE-2022-23034
Debian:13xen4.16.0+51-g0941d6cb-1DEBIAN-CVE-2022-23034
Debian:14xen4.16.0+51-g0941d6cb-1DEBIAN-CVE-2022-23034
Ubuntu:22.04:LTSxenno fix listedUBUNTU-CVE-2022-23034
Ubuntu:24.04:LTSxenno fix listedUBUNTU-CVE-2022-23034
Ubuntu:25.10xenno fix listedUBUNTU-CVE-2022-23034
Ubuntu:26.04:LTSxenno fix listedUBUNTU-CVE-2022-23034
Ubuntu:26.10xenno fix listedUBUNTU-CVE-2022-23034

Affected products (as reported)

VendorProductVersions
Xen xen see references

References