« Volver al listado

CVE-2022-23034

Estado: ModificadaMedia (5.5)—

Un huésped PV podría hacer DoS a Xen mientras desmapea una concesión Para abordar XSA-380, fue introducido el recuento de referencias para las asignaciones de concesión para el caso en que un huésped PV tuviera el IOMMU habilitado. Los huéspedes PV pueden solicitar dos formas de mapeo. Cuando ambas están usadas para cualquier mapeo individual, el desmapeo de tal mapeo puede ser solicitado en dos pasos. El conteo de referencia para tal mapeo sería entonces erróneamente decrementado dos veces. Se detecta un desbordamiento de los contadores, resultando en el desencadenamiento de una comprobación de errores del hipervisor

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Debian — Debian LinuxFedoraproject — FedoraXEN — XEN

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-23034",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@xen.org",
      "affectedData": [
        {
          "vendor": "Xen",
          "product": "xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-394"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-25T14:15:09.010",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2022/01/25/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@xen.org"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3/",
      "source": "security@xen.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/202208-23",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@xen.org"
    },
    {
      "url": "https://www.debian.org/security/2022/dsa-5117",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@xen.org"
    },
    {
      "url": "https://xenbits.xenproject.org/xsa/advisory-394.txt",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@xen.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2022/01/25/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202208-23",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2022/dsa-5117",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://xenbits.xenproject.org/xsa/advisory-394.txt",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-191"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference count for such a mapping would then mistakenly be decremented twice. Underflow of the counters gets detected, resulting in the triggering of a hypervisor bug check."
    },
    {
      "lang": "es",
      "value": "Un huésped PV podría hacer DoS a Xen mientras desmapea una concesión Para abordar XSA-380, fue introducido el recuento de referencias para las asignaciones de concesión para el caso en que un huésped PV tuviera el IOMMU habilitado. Los huéspedes PV pueden solicitar dos formas de mapeo. Cuando ambas están usadas para cualquier mapeo individual, el desmapeo de tal mapeo puede ser solicitado en dos pasos. El conteo de referencia para tal mapeo sería entonces erróneamente decrementado dos veces. Se detecta un desbordamiento de los contadores, resultando en el desencadenamiento de una comprobación de errores del hipervisor"
    }
  ],
  "lastModified": "2026-06-17T04:29:23.240",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "79DBA39F-1E66-4962-98C5-18B48C2F6E41",
              "versionEndExcluding": "4.13.0",
              "versionStartIncluding": "3.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@xen.org"
}