CVE-2022-33747

Katalog CVE

CVSS 3.8 · Low EPSS 0,29%

Kerentanan Improper Resource Shutdown or Release pada xen, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 3.8 (Low) menurut NVD.

Deskripsi (NVD)

Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping with individual smaller ones). These memory allocations are taken from the global memory pool. A malicious guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings.

Rincian

Terbit di NVD

11 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.8 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://xenbits.xen.org/xsa/advisory-409.html patch · advisory vendor
• https://xenbits.xenproject.org/xsa/advisory-409.txt patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/10/11/5 mailing list · patch · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5272 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJOMUNGW6VTK5...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWSC77GS5NATI...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6...
• https://security.gentoo.org/glsa/202402-07