Log in Start free

Vulnerability · Published Oct 11, 2022 · Assigned by XEN

CVE-2022-33747

Low 3.8

In plain English

A low-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.8Low
Exploit odds (30 days)0.3%top 78.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping with individual smaller ones). These memory allocations are taken from the global memory pool. A malicious guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xen4.17.0-r0ALPINE-CVE-2022-33747
Alpine:v3.21xen4.17.0-r0ALPINE-CVE-2022-33747
Alpine:v3.22xen4.17.0-r0ALPINE-CVE-2022-33747
Alpine:v3.23xen4.17.0-r0ALPINE-CVE-2022-33747
Alpine:v3.24xen4.17.0-r0ALPINE-CVE-2022-33747
Debian:12xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-33747
Debian:13xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-33747
Debian:14xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-33747
Ubuntu:22.04:LTSxenno fix listedUBUNTU-CVE-2022-33747
Ubuntu:24.04:LTSxenno fix listedUBUNTU-CVE-2022-33747
Ubuntu:25.10xenno fix listedUBUNTU-CVE-2022-33747
Ubuntu:26.04:LTSxenno fix listedUBUNTU-CVE-2022-33747
Ubuntu:26.10xenno fix listedUBUNTU-CVE-2022-33747

Affected products (as reported)

VendorProductVersions
Xen xen see references

References