CVE-2022-23033
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more...
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
- Record
CVE-2022-23033- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-404
- Updated
- 2026-11-02
CVE List No score
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
- Record
CVE-2022-23033- Updated
- 2026-11-02
EUVDEUVD-2022-28144 No score
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
- Record
EUVD-2022-28144- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-74f6-jp2h-2vw3
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more...
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
- Record
GHSA-74f6-jp2h-2vw3- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-23033
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
- Record
ALPINE-CVE-2022-23033- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
- Record
CVE-2022-23033- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2022-23033
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
- Record
DEBIAN-CVE-2022-23033- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-23033
arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
- Record
UBUNTU-CVE-2022-23033- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0333-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2022-23033: Fixed guest_physmap_remove_page not removing the p2m mappings. (XSA-393) (bsc#1194576)
- CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. (XSA-394) (bsc#1194581)
- CVE-2022-23035: Fixed insufficient cleanup of passed-through device IRQs. (XSA-395) (bsc#1194588)
- Record
openSUSE-SU-2022:0333-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11781-1 No score
xen-4.16.0_04-3.1 on GA media
These are all security issues fixed in the xen-4.16.0_04-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11781-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0333-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2022-23033: Fixed guest_physmap_remove_page not removing the p2m mappings. (XSA-393) (bsc#1194576)
- CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. (XSA-394) (bsc#1194581)
- CVE-2022-23035: Fixed insufficient cleanup of passed-through device IRQs. (XSA-395) (bsc#1194588)
- Record
SUSE-SU-2022:0333-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0467-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2022-23033: Fixed guest_physmap_remove_page not removing the p2m mappings. (XSA-393) (bsc#1194576)
- CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. (XSA-394) (bsc#1194581)
- CVE-2022-23035: Fixed insufficient cleanup of passed-through device IRQs. (XSA-395) (bsc#1194588)
- Record
SUSE-SU-2022:0467-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0468-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2022-23033: Fixed guest_physmap_remove_page not removing the p2m mappings. (XSA-393) (bsc#1194576)
- CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. (XSA-394) (bsc#1194581)
- CVE-2022-23035: Fixed insufficient cleanup of passed-through device IRQs. (XSA-395) (bsc#1194588)
- Record
SUSE-SU-2022:0468-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0469-1 No score
Security update for xen
This update for xen fixes the following issues:
- CVE-2022-23033: Fixed guest_physmap_remove_page not removing the p2m mappings. (XSA-393) (bsc#1194576)
- CVE-2022-23034: Fixed possible DoS by a PV guest Xen while unmapping a grant. (XSA-394) (bsc#1194581)
- CVE-2022-23035: Fixed insufficient cleanup of passed-through device IRQs. (XSA-395) (bsc#1194588)
- Record
SUSE-SU-2022:0469-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenAlpine:v3.12 |
4.12.0 up to 4.13.4-r3 | 4.13.4-r3 |
xenAlpine:v3.13 |
4.12.0 up to 4.14.5-r0 | 4.14.5-r0 |
xenAlpine:v3.14 |
4.12.0 up to 4.15.2-r0 | 4.15.2-r0 |
xenAlpine:v3.15 |
4.12.0 up to 4.15.2-r0 | 4.15.2-r0 |
xenAlpine:v3.16 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
xenAlpine:v3.17 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
xenAlpine:v3.18 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
xenAlpine:v3.19 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
xenAlpine:v3.20 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
xenAlpine:v3.21 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
Show 40 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xenAlpine:v3.22 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
xenAlpine:v3.23 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
xenAlpine:v3.24 |
4.12.0 up to 4.16.1-r0 | 4.16.1-r0 |
xenDebian:12 |
before 4.16.0+51-g0941d6cb-1 | 4.16.0+51-g0941d6cb-1 |
xenDebian:13 |
before 4.16.0+51-g0941d6cb-1 | 4.16.0+51-g0941d6cb-1 |
xenDebian:14 |
before 4.16.0+51-g0941d6cb-1 | 4.16.0+51-g0941d6cb-1 |
xenDebian:11 From an advisory covering 9 CVEs |
before 4.14.4+74-gd7b22226b5-1, plus listed versions 4.14.2+25-gb6a8c4f72d-24.14.3+32-g9de3671772-14.14.3+32-g9de3671772-1~deb11u14.14.3-14.14.3-1~deb11u1 |
4.14.4+74-gd7b22226b5-1 |
xenSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 3 CVEs |
before 4.14.3_06-150300.3.18.2 | 4.14.3_06-150300.3.18.2 |
xenSUSE:Linux Enterprise Module for Server Applications 15 SP3 From an advisory covering 3 CVEs |
before 4.14.3_06-150300.3.18.2 | 4.14.3_06-150300.3.18.2 |
xenSUSE:Linux Enterprise Micro 5.1 From an advisory covering 3 CVEs |
before 4.14.3_06-150300.3.18.2 | 4.14.3_06-150300.3.18.2 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Manager Proxy 4.1 From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Manager Retail Branch Server 4.1 From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Manager Server 4.1 From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Linux Enterprise Micro 5.0 From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Enterprise Storage 7 From an advisory covering 3 CVEs |
before 4.13.4_04-3.43.2 | 4.13.4_04-3.43.2 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 3 CVEs |
before 4.12.4_18-3.60.2 | 4.12.4_18-3.60.2 |
xenSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 3 CVEs |
before 4.12.4_18-3.60.2 | 4.12.4_18-3.60.2 |
xenSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 3 CVEs |
before 4.12.4_18-3.60.2 | 4.12.4_18-3.60.2 |
xenSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 3 CVEs |
before 4.12.4_18-3.60.2 | 4.12.4_18-3.60.2 |
xenSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 3 CVEs |
before 4.12.4_18-3.60.2 | 4.12.4_18-3.60.2 |
xenSUSE:Enterprise Storage 6 From an advisory covering 3 CVEs |
before 4.12.4_18-3.60.2 | 4.12.4_18-3.60.2 |
xenSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 3 CVEs |
before 4.12.4_18-3.58.2 | 4.12.4_18-3.58.2 |
xenSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 3 CVEs |
before 4.12.4_18-3.58.2 | 4.12.4_18-3.58.2 |
xenSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 3 CVEs |
before 4.12.4_18-3.58.2 | 4.12.4_18-3.58.2 |
xenUbuntu:16.04:LTS |
All versions, plus listed versions 4.5.1-0ubuntu14.5.1-0ubuntu24.6.0-1ubuntu14.6.0-1ubuntu24.6.0-1ubuntu4 Show 7 moreShow less4.6.0-1ubuntu4.14.6.0-1ubuntu4.24.6.0-1ubuntu4.34.6.5-0ubuntu14.6.5-0ubuntu1.14.6.5-0ubuntu1.24.6.5-0ubuntu1.4 |
None known |
xenUbuntu:18.04:LTS |
All versions, plus listed versions 4.9.0-0ubuntu34.9.0-0ubuntu44.9.2-0ubuntu1 |
None known |
xenUbuntu:20.04:LTS |
All versions, plus listed versions 4.9.2-0ubuntu24.9.2-0ubuntu64.9.2-0ubuntu74.11.3+24-g14b62ab3e5-1ubuntu14.11.3+24-g14b62ab3e5-1ubuntu24.11.3+24-g14b62ab3e5-1ubuntu2.24.11.3+24-g14b62ab3e5-1ubuntu2.3 |
None known |
xenUbuntu:22.04:LTS |
All versions, plus listed versions 4.11.4+24-gddaaccbbab-1ubuntu24.16.0-1~ubuntu24.16.0-1~ubuntu2.1 |
None known |
xenUbuntu:24.04:LTS |
All versions, plus listed versions 4.17.2-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1ubuntu14.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.1ubuntu24.17.3+10-g091466ba55-1.1ubuntu3 |
None known |
xenUbuntu:25.10 |
All versions, plus listed versions 4.20.0-1ubuntu14.20.0+68-g35cb38b222-1 |
None known |
xenUbuntu:26.10 |
All versions, plus listed versions 4.20.2+7-g1badcf5035-2build24.20.2+37-g61ff35323e-1ubuntu14.20.3+127-gc42374a105-1 |
None known |
xenUbuntu:26.04:LTS |
All versions, plus listed versions 4.20.0+68-g35cb38b222-14.20.2+7-g1badcf5035-24.20.2+7-g1badcf5035-2build2 |
None known |
xenopenSUSE:Leap 15.3 From an advisory covering 3 CVEs |
before 4.14.3_06-150300.3.18.2 | 4.14.3_06-150300.3.18.2 |
xenopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 4.16.0_04-3.1 | 4.16.0_04-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-23033 is a high vulnerability (CVSS 7.8) in Xen, published January 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in xen 4.13.4-r3.
References
xenbits.xenproject.org/xsa/advisory-393.txt
openwall.com/lists/oss-security/2022/01/25/2
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3
debian.org/security/2022/dsa-5117
security.gentoo.org/glsa/202208-23
nvd.nist.gov/vuln/detail/CVE-2022-23033
Show 18 moreShow less
github.com/advisories/GHSA-74f6-jp2h-2vw3
security.alpinelinux.org/vuln/CVE-2022-23033
security-tracker.debian.org/tracker/CVE-2022-23033
suse.com/support/update/announcement/2022/suse-su-20220333-1
bugzilla.suse.com/1194576
ubuntu.com/security/CVE-2022-23033
xenbits.xen.org/xsa/advisory-393.html
cve.org/CVERecord?id=CVE-2022-23033
lists.opensuse.org/archives/list/[email protected]/thread/XIM2A32O55DKEA5CCA7L5EE2KL4DYQJF