CVE-2022-33747: Low severity xen xapi vulnerability
Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping with individual smaller ones). These memory allocations are taken from the global memory pool. A malicious guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-33747.
What is the severity of CVE-2022-33747?
The severity of CVE-2022-33747 is low with a severity value of 3.8.
Which software is affected by CVE-2022-33747?
The software affected by CVE-2022-33747 includes Xen Xen, Xen Xen on Arm, Fedoraproject Fedora versions 35, 36, and 37, and Debian Debian Linux version 11.0.
How can I fix CVE-2022-33747?
To fix CVE-2022-33747, update your software to one of the following versions: Xen 4.14.6-1, Xen 4.14.5+94-ge49571868d-1, Xen 4.17.1+2-gb773c48e36-1, Xen 4.17.2+55-g0b56bed864-1.
Where can I find more information about CVE-2022-33747?
You can find more information about CVE-2022-33747 at the following references: [XSA advisory-409](https://xenbits.xen.org/xsa/advisory-409.html), [Debian security tracker](https://security-tracker.debian.org/tracker/CVE-2022-33747), [Openwall mailing list](http://www.openwall.com/lists/oss-security/2022/10/11/5).