cvelist/2022/33xxx/CVE-2022-33747.json

{
   "CVE_data_meta" : {
      "ASSIGNER" : "security@xenproject.org",
      "ID" : "CVE-2022-33747"
   },
   "affects" : {
      "vendor" : {
         "vendor_data" : [
            {
               "product" : {
                  "product_data" : [
                     {
                        "product_name" : "xen",
                        "version" : {
                           "version_data" : [
                              {
                                 "version_affected" : "?",
                                 "version_value" : "consult Xen advisory XSA-409"
                              }
                           ]
                        }
                     }
                  ]
               },
               "vendor_name" : "Xen"
            }
         ]
      }
   },
   "configuration" : {
      "configuration_data" : {
         "description" : {
            "description_data" : [
               {
                  "lang" : "eng",
                  "value" : "All versions of Xen are affected.\n\nOnly Arm systems are vulnerable.  x86 systems are not vulnerable."
               }
            ]
         }
      }
   },
   "data_format" : "MITRE",
   "data_type" : "CVE",
   "data_version" : "4.0",
   "description" : {
      "description_data" : [
         {
            "lang" : "eng",
            "value" : "Arm: unbounded memory consumption for 2nd-level page tables\n\nCertain actions require e.g. removing pages from a guest's P2M\n(Physical-to-Machine) mapping.  When large pages are in use to map guest\npages in the 2nd-stage page tables, such a removal operation may incur a\nmemory allocation (to replace a large mapping with individual smaller\nones).\n\nThese memory allocations are taken from the global memory pool. A\nmalicious guest might be able to cause the global memory pool to be\nexhausted by manipulating its own P2M mappings."
         }
      ]
   },
   "impact" : {
      "impact_data" : {
         "description" : {
            "description_data" : [
               {
                  "lang" : "eng",
                  "value" : "A malicious guest could cause a Denial of Service, preventing any system\noperation requiring further allocation of Xen memory, including creating\nnew guests.  NB however that memory exhaustion by itself shouldn’t cause\neither Xen or properly-written guests to crash."
               }
            ]
         }
      }
   },
   "problemtype" : {
      "problemtype_data" : [
         {
            "description" : [
               {
                  "lang" : "eng",
                  "value" : "unknown"
               }
            ]
         }
      ]
   },
   "references" : {
      "reference_data" : [
         {
            "url" : "https://xenbits.xenproject.org/xsa/advisory-409.txt"
         }
      ]
   },
   "workaround" : {
      "workaround_data" : {
         "description" : {
            "description_data" : [
               {
                  "lang" : "eng",
                  "value" : "There is no known mitigation."
               }
            ]
         }
      }
   }
}