Vulnerability · Published Apr 5, 2022 · Assigned by XEN
CVE-2022-26361
High 7.8
In plain English
A high-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with such a region is active, the mappings of these regions need to remain continuouly accessible by the device. This requirement has been violated. Subsequent DMA or interrupts from the device may have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xen | 4.16.1-r0 | ALPINE-CVE-2022-26361 |
| Alpine:v3.21 | xen | 4.16.1-r0 | ALPINE-CVE-2022-26361 |
| Alpine:v3.22 | xen | 4.16.1-r0 | ALPINE-CVE-2022-26361 |
| Alpine:v3.23 | xen | 4.16.1-r0 | ALPINE-CVE-2022-26361 |
| Alpine:v3.24 | xen | 4.16.1-r0 | ALPINE-CVE-2022-26361 |
| Debian:12 | xen | 4.16.1-1 | DEBIAN-CVE-2022-26361 |
| Debian:13 | xen | 4.16.1-1 | DEBIAN-CVE-2022-26361 |
| Debian:14 | xen | 4.16.1-1 | DEBIAN-CVE-2022-26361 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2022-26361 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2022-26361 |
| Ubuntu:25.10 | xen | no fix listed | UBUNTU-CVE-2022-26361 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2022-26361 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2022-26361 |
Affected products (as reported)
References
- https://xenbits.xenproject.org/xsa/advisory-400.txt
- http://xenbits.xen.org/xsa/advisory-400.html
- [oss-security] 20220405 Xen Security Advisory 400 v2 (CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361) - IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues mailing-list
- DSA-5117 vendor-advisory
- FEDORA-2022-dfbf7e2372 vendor-advisory
- FEDORA-2022-64b2c02d29 vendor-advisory
- GLSA-202402-07 vendor-advisory