SB2022122163 - Denial of service in Xen Linux netback driver

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource management error (CVE-ID: CVE-2022-42328)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

2) Resource management error (CVE-ID: CVE-2022-42329)

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

Remediation

Install update from vendor's website.

References

• https://xenbits.xenproject.org/xsa/advisory-424.txt
• http://www.openwall.com/lists/oss-security/2022/12/08/3
• http://www.openwall.com/lists/oss-security/2022/12/08/2
• http://www.openwall.com/lists/oss-security/2022/12/09/2