<p>Upgrade <code>Alpine:3.15</code> <code>xen</code> to version 4.15.2-r2 or higher.</p>

Improper Locking Affecting xen package, versions <4.15.2-r2

Snyk CVSS

Attack Complexity High

Scope Changed

Availability High

Threat Intelligence

EPSS 0.05% (14^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ALPINE315-XEN-2945005
published 16 Apr 2022
disclosed 5 Apr 2022

Report a new vulnerability Found a mistake?

Introduced: 5 Apr 2022

CVE-2022-26356 Open this link in a new tab CWE-667 Open this link in a new tab

How to fix?

Upgrade Alpine:3.15 xen to version 4.15.2-r2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xen package and not the xen package as distributed by Alpine. See How to fix? for Alpine:3.15 relevant fixed versions and status.

Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a previously enabled log dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both operations and can lead to entries being added in already freed slots, resulting in a memory leak.