Log in Start free

Vulnerability · Published Oct 11, 2022 · Assigned by XEN

CVE-2022-33748

Medium 5.6

In plain English

A medium-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.6Medium
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xen4.17.0-r0ALPINE-CVE-2022-33748
Alpine:v3.21xen4.17.0-r0ALPINE-CVE-2022-33748
Alpine:v3.22xen4.17.0-r0ALPINE-CVE-2022-33748
Alpine:v3.23xen4.17.0-r0ALPINE-CVE-2022-33748
Alpine:v3.24xen4.17.0-r0ALPINE-CVE-2022-33748
Debian:12xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-33748
Debian:13xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-33748
Debian:14xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-33748
Ubuntu:22.04:LTSxenno fix listedUBUNTU-CVE-2022-33748
Ubuntu:24.04:LTSxenno fix listedUBUNTU-CVE-2022-33748
Ubuntu:25.10xenno fix listedUBUNTU-CVE-2022-33748
Ubuntu:26.04:LTSxenno fix listedUBUNTU-CVE-2022-33748
Ubuntu:26.10xenno fix listedUBUNTU-CVE-2022-33748

Affected products (as reported)

VendorProductVersions
Xen xen see references

References