CVE-2022-26359 – This vulnerability affects systems with Intel V... (How to Fix)

Q: What is the severity of CVE-2022-26359?

CVE-2022-26359 has a CVSS score of 7.8 (HIGH). This vulnerability affects systems with Intel VT-d or AMD-Vi IOMMU technology when certain PCI devices use reserved memory regions. It allows DMA or interrupts from affected devices to cause unpredictable behavior ranging from IOMMU faults to memory corruption. Systems using Xen hypervisor with these IOMMU features are primarily affected.

📋 TL;DR

This vulnerability affects systems with Intel VT-d or AMD-Vi IOMMU technology when certain PCI devices use reserved memory regions. It allows DMA or interrupts from affected devices to cause unpredictable behavior ranging from IOMMU faults to memory corruption. Systems using Xen hypervisor with these IOMMU features are primarily affected.

💻 Affected Systems

Products:

Xen Hypervisor

Versions: All versions prior to fixes in XSA-400

Operating Systems: Linux distributions running Xen (Fedora, Gentoo, others)

Default Config Vulnerable: ⚠️ Yes

Notes: Requires systems with Intel VT-d or AMD-Vi IOMMU enabled and specific PCI devices using RMRR/Unity Mapping features.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Memory corruption leading to system crashes, data loss, or potential privilege escalation through DMA attacks.

🟠

Likely Case

System instability, IOMMU faults causing device failures, or hypervisor crashes affecting virtual machines.

🟢

If Mitigated

Limited to specific PCI device malfunctions if proper isolation controls are in place.

🌐 Internet-Facing: LOW - Requires local access to affected hardware and specific PCI device configurations.

🏢 Internal Only: MEDIUM - Affects virtualization hosts and systems with specific PCI hardware configurations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific hardware configurations and access to trigger DMA/interrupts from affected PCI devices.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Xen security advisory XSA-400 patches

Vendor Advisory: http://xenbits.xen.org/xsa/advisory-400.html

Restart Required: Yes

Instructions:

1. Update Xen hypervisor to patched version. 2. Apply distribution-specific patches from Fedora, Gentoo, or other vendors. 3. Reboot the hypervisor host.

🔧 Temporary Workarounds

Disable affected PCI devices

linux

Identify and disable PCI devices using RMRR/Unity Mapping features

lspci -v | grep -i rmrr
echo 1 > /sys/bus/pci/devices/[DEVICE]/remove

Disable IOMMU features

all

Disable Intel VT-d or AMD-Vi in BIOS/UEFI settings

🧯 If You Can't Patch

Isolate affected systems from critical infrastructure
Monitor for IOMMU fault logs and system instability

🔍 How to Verify

Check if Vulnerable:

Check Xen version and if IOMMU is enabled: 'xl info | grep -i xen_version' and 'dmesg | grep -i iommu'

Check Version:

xl info | grep xen_version

Verify Fix Applied:

Verify Xen version includes XSA-400 patches: 'xl info' should show patched version

📡 Detection & Monitoring

Log Indicators:

IOMMU fault messages in dmesg
Xen hypervisor crash logs
PCI device DMA errors

Network Indicators:

Unusual VM migration failures
Hypervisor management interface disruptions

SIEM Query:

source="dmesg" AND "IOMMU" AND ("fault" OR "error")

📊 Metadata

CVE ID: CVE-2022-26359

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published: April 5, 2022

Last Updated: November 21, 2024

🔗 References

http://www.openwall.com/lists/oss-security/2022/04/05/3 Mailing List,Patch,Third Party Advisory
http://xenbits.xen.org/xsa/advisory-400.html Patch,Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ETPM2OVZZ6KOS2L7QO7SIW6XWT5OW3F/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHFSRVLM2JUCPDC2KGB7ETPQYJLCGBLD/
https://security.gentoo.org/glsa/202402-07
https://www.debian.org/security/2022/dsa-5117 Third Party Advisory
https://xenbits.xenproject.org/xsa/advisory-400.txt Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/04/05/3 Mailing List,Patch,Third Party Advisory
http://xenbits.xen.org/xsa/advisory-400.html Patch,Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ETPM2OVZZ6KOS2L7QO7SIW6XWT5OW3F/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHFSRVLM2JUCPDC2KGB7ETPQYJLCGBLD/
https://security.gentoo.org/glsa/202402-07
https://www.debian.org/security/2022/dsa-5117 Third Party Advisory
https://xenbits.xenproject.org/xsa/advisory-400.txt Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON