CVE-2022-23035

Name	CVE-2022-23035
Description	Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked, the cleanup attempt may be scheduled to be retried. When multiple interrupts are involved, this scheduling of a retry may get erroneously skipped. At the same time pointers may get cleared (resulting in a de-reference of NULL) and freed (resulting in a use-after-free), while other code would continue to assume them to be valid.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5117-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xen (PTS)	jessie, jessie (lts)	4.4.4lts5-0+deb8u1	vulnerable
	stretch (security), stretch (lts), stretch	4.8.5.final+shim4.10.4-1+deb9u12	vulnerable
	buster (security), buster, buster (lts)	4.11.4+107-gef32c7afa2-1	vulnerable
	bullseye	4.14.6-1	fixed
	bullseye (security)	4.14.5+94-ge49571868d-1	fixed
	bookworm	4.17.3+10-g091466ba55-1~deb12u1	fixed
	sid, trixie	4.17.3+36-g54dacb5c02-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
xen	source	jessie	(unfixed)	end-of-life
xen	source	stretch	(unfixed)	end-of-life
xen	source	buster	(unfixed)	end-of-life
xen	source	bullseye	4.14.4+74-gd7b22226b5-1		DSA-5117-1
xen	source	(unstable)	4.16.0+51-g0941d6cb-1

[buster] - xen <end-of-life> (DSA 4677-1)
[stretch] - xen <end-of-life> (DSA 4602-1)
https://xenbits.xen.org/xsa/advisory-395.html