CVE-2022-33743: High severity Linux Linux kernel vulnerability
A flaw memory leak in the Linux Kernel XDP (eXpress Data Path) was found. It can lead to denial of service for some specific configurations like if the non root privileged user from the host system can send malicious packets to the guest systems. This flaw actual for the Linux Kernel versions 5.9 - 5.18.
References: https://www.openwall.com/lists/oss-security/2022/07/05/5 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/net/xen-netfront.c?h=v5.19-rc7&id=f63c2c2032c2e3caad9add3b82cc6e91c376fd26
Other sources
An incomplete cleanup flaw was found in the Linux kernel’s Xen networking XDP (eXpress Data Path) subsystem. This flaw allows a local user to crash the system.
network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further processing to nevertheless be freed.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-33743?
CVE-2022-33743 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2022-33743?
To mitigate CVE-2022-33743, upgrade to a patched version of the Linux Kernel, specifically 5.14.0-284.11.1.el9_2 or later.
Which Linux Kernel versions are affected by CVE-2022-33743?
CVE-2022-33743 affects Linux Kernel versions from 5.9 up to, but not including, 5.19.
Can non-root users exploit CVE-2022-33743?
Yes, a non-root privileged user can exploit CVE-2022-33743 by sending malicious packets to guest systems.
What systems are impacted by CVE-2022-33743?
CVE-2022-33743 affects systems running specific versions of the Linux Kernel, Xen hypervisor, and Debian Linux.