Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2022-33746: P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable w...
CVE-2022-33746 · published 4 years ago
Summary
P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks. Such checking for the need to preempt was so far missing.
What to do
- Update debian xen to version 4.16.2+90-g0d39a6d1ae-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | xen | xen |
>= 4.13.0, <= 4.16.1 cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
35 36 37 cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| – | debian | debian_linux |
11.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | xen | All versions |
| Debian:12 | debian | xen |
< 4.16.2+90-g0d39a6d1ae-1 Fix: upgrade to 4.16.2+90-g0d39a6d1ae-1
|
Original advisory text
P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable w...
P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks. Such checking for the need to preempt was so far missing.
References
- https://ubuntu.com/security/CVE-2022-33746 Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-410.html Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-33746 Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-410.html Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/10/11/3 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/202402-07
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://www.debian.org/security/2022/dsa-5272 Third Party Advisory
- https://xenbits.xenproject.org/xsa/advisory-410.txt Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-33746 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-404Improper Resource Shutdown or Release
Timeline
Published11 Oct 2022
Updated3 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta