CVE-2022-23035
CVE-2022-23035 is a medium-severity vulnerability in Xen with a CVSS 3.x base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-459.
Key facts
- Severity: Medium (CVSS 3.x base score 4.6)
- CVSS v2: 4.7
- EPSS exploit prediction: 0% (27th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-459
- Affected product: Xen
- Published:
- Last modified:
Description
Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked, the cleanup attempt may be scheduled to be retried. When multiple interrupts are involved, this scheduling of a retry may get erroneously skipped. At the same time pointers may get cleared (resulting in a de-reference of NULL) and freed (resulting in a use-after-free), while other code would continue to assume them to be valid.
Frequently asked questions
- What is CVE-2022-23035?
- Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked, the cleanup attempt may be scheduled to be retried. When multiple interrupts are involved, this scheduling of a retry may get erroneously skipped. At the same time pointers may get cleared (resulting in a de-reference of NULL) and freed (resulting in a use-after-free), while other code would continue to assume them to be valid.
- How severe is CVE-2022-23035?
- CVE-2022-23035 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2022-23035 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-23035?
- CVE-2022-23035 primarily affects Xen. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2022-23035?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2022-23035 published?
- CVE-2022-23035 was published on 2022-01-25 and last updated on 2026-06-17.
References
- http://www.openwall.com/lists/oss-security/2022/01/25/4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3/
- https://security.gentoo.org/glsa/202208-23
- https://www.debian.org/security/2022/dsa-5117
- https://xenbits.xenproject.org/xsa/advisory-395.txt
Affected products (3)
- cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
More vulnerabilities in Xen
- CVE-2017-10921 — Critical (CVSS 10.0): The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and…
- CVE-2017-10920 — Critical (CVSS 10.0): The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed…
- CVE-2017-10918 — Critical (CVSS 10.0): Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to…
- CVE-2017-10912 — Critical (CVSS 10.0): Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka…
- CVE-2015-8104 — Critical (CVSS 10.0): The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a…
- CVE-2018-12892 — Critical (CVSS 9.9): An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI…
Other CWE-459 vulnerabilities
- CVE-2023-36468 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki…
- CVE-2022-45347 — Critical (CVSS 9.8): Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session…
- CVE-2021-45330 — Critical (CVSS 9.8): An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies…
- CVE-2021-45706 — Critical (CVSS 9.8): An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- CVE-2021-32928 — Critical (CVSS 9.8): The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License…
- CVE-2020-13451 — Critical (CVSS 9.8): An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to…