CVE-2022-23035 — Incomplete Cleanup in XEN
Severity
4.6MEDIUMNVD
EPSS
0.1%
top 69.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 25
Latest updateJan 26
Description
Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked, the cleanup attempt may be scheduled to be retried. When multiple interrupts are involved, this scheduling of a retry may get erroneously skipped. At the same time pointers may…
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 0.9 | Impact: 3.6
Affected Packages3 packages
Also affects: Debian Linux 11.0, Fedora 34
Patches
🔴Vulnerability Details
2GHSA▶
GHSA-5x5q-fcw5-7frv: Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an itera↗2022-01-26
OSV▶
CVE-2022-23035: Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an itera↗2022-01-25