CVE-2022-33743

Name of the Vulnerable Software and Affected Versions Xen (affected versions not specified) Linux (affected versions not specified)

Description The issue is related to insufficient input validation in the Xen hypervisor and Linux kernel, which can be exploited by a remote attacker to execute arbitrary code. The problem lies in the network backend, where a code change to support XDP (eXpress Data Path) allowed SKBs (socket buffers) with retained references to be freed, potentially causing Linux netfront to use freed SKBs.

Recommendations For Xen, consider disabling the network backend functionality until a patch is available. For Linux, restrict access to the netfront module to minimize the risk of exploitation. As a temporary workaround, avoid using the XDP feature in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.