5.6 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:H/Au:S/C:N/I:N/A:P
0.0004 Low
EPSS
Percentile
12.6%
lock order inversion in transitive grant copy handling As part of XSA-226 a
missing cleanup call was inserted on an error handling path. While doing
so, locking requirements were not paid attention to. As a result two
cooperating guests granting each other transitive grants can cause locks to
be acquired nested within one another, but in respectively opposite order.
With suitable timing between the involved grant copy operations this may
result in the locking up of a CPU.
Author | Note |
---|---|
mdeslaur | hypervisor packages are in universe. For issues in the hypervisor, add appropriate tags to each section, ex: Tags_xen: universe-binary |
www.openwall.com/lists/oss-security/2022/10/11/2
xenbits.xen.org/xsa/advisory-411.html
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33748
launchpad.net/bugs/cve/CVE-2022-33748
nvd.nist.gov/vuln/detail/CVE-2022-33748
security-tracker.debian.org/tracker/CVE-2022-33748
xenbits.xen.org/xsa/advisory-411.html
xenbits.xenproject.org/xsa/advisory-411.txt
5.6 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:H/Au:S/C:N/I:N/A:P
0.0004 Low
EPSS
Percentile
12.6%