What is CVE-2022-23033?

CVE-2022-23033 is a high-severity vulnerability in Xen, classified under Improper Resource Shutdown or Release. CVSS score: 7.8/10. Published 2022-01-25.

How severe is CVE-2022-23033?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Xen

CVE-2022-23033

arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.

Published 2022-01-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.003 (25.0th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Xen — versions consult Xen advisory XSA-393
Debian Linux — versions 11.0
Fedoraproject Fedora — versions 34

Weakness classification (CWE)

CWE-404 — Improper Resource Shutdown or Release

References

xenbits.xenproject.org/xsa/advisory-393.txt (Vendor Advisory)
www.openwall.com/lists/oss-security/2022/01/25/2 (mailing-list, Patch, Mailing List, Third Party Advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
www.debian.org/security/2022/dsa-5117 (vendor-advisory, Third Party Advisory)
security.gentoo.org/glsa/202208-23 (vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2022-23033?: CVE-2022-23033 is a high-severity vulnerability in Xen, classified under Improper Resource Shutdown or Release. CVSS score: 7.8/10. Published 2022-01-25.
How severe is CVE-2022-23033?: High severity. CVSS v3 base score is 7.8 out of 10.