Vulnerability · Published Jan 25, 2022 · Assigned by XEN
CVE-2022-23033
High 7.8
In plain English
A high-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xen | 4.16.1-r0 | ALPINE-CVE-2022-23033 |
| Alpine:v3.21 | xen | 4.16.1-r0 | ALPINE-CVE-2022-23033 |
| Alpine:v3.22 | xen | 4.16.1-r0 | ALPINE-CVE-2022-23033 |
| Alpine:v3.23 | xen | 4.16.1-r0 | ALPINE-CVE-2022-23033 |
| Alpine:v3.24 | xen | 4.16.1-r0 | ALPINE-CVE-2022-23033 |
| Debian:12 | xen | 4.16.0+51-g0941d6cb-1 | DEBIAN-CVE-2022-23033 |
| Debian:13 | xen | 4.16.0+51-g0941d6cb-1 | DEBIAN-CVE-2022-23033 |
| Debian:14 | xen | 4.16.0+51-g0941d6cb-1 | DEBIAN-CVE-2022-23033 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2022-23033 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2022-23033 |
| Ubuntu:25.10 | xen | no fix listed | UBUNTU-CVE-2022-23033 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2022-23033 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2022-23033 |
Affected products (as reported)
References
- https://xenbits.xenproject.org/xsa/advisory-393.txt x_refsource_MISC
- [oss-security] 20220125 Xen Security Advisory 393 v2 (CVE-2022-23033) - arm: guest_physmap_remove_page not removing the p2m mappings mailing-list, x_refsource_MLIST
- FEDORA-2022-0cc3916e08 vendor-advisory, x_refsource_FEDORA
- DSA-5117 vendor-advisory, x_refsource_DEBIAN
- GLSA-202208-23 vendor-advisory, x_refsource_GENTOO