CVE-2022-33748

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU.

• CWE-755

• http://www.openwall.com/lists/oss-security/2022/10/11/2Mailing List, Mitigation, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-411.htmlMitigation, Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJOMUNGW6VTK5CZZRLWLVVEOUPEQBRHI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWSC77GS5NATI3TT7FMVPULUPXR635XQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
• https://security.gentoo.org/glsa/202402-07
• https://www.debian.org/security/2022/dsa-5272Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-411.txtMitigation, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/10/11/2Mailing List, Mitigation, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-411.htmlMitigation, Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TJOMUNGW6VTK5CZZRLWLVVEOUPEQBRHI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWSC77GS5NATI3TT7FMVPULUPXR635XQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
• https://security.gentoo.org/glsa/202402-07
• https://www.debian.org/security/2022/dsa-5272Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-411.txtMitigation, Patch, Vendor Advisory

Published

Oct 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-33742Linux disk/nic frontends data leaks T[his CNA information re…7.1
• CVE-2022-33743network backend may cause Linux netfront to use freed SKBs W…7.8
• CVE-2022-33744Arm guests can cause Dom0 DoS via PV devices When mapping pa…4.7
• CVE-2022-33745insufficient TLB flush for x86 PV guests in shadow mode For …8.8
• CVE-2022-33746P2M pool freeing may take excessively long The P2M pool back…6.5
• CVE-2022-33747Arm: unbounded memory consumption for 2nd-level page tables …3.8
• CVE-2022-33749XAPI open file limit DoS It is possible for an unauthenticat…5.3
• CVE-2022-3375An issue has been discovered in GitLab affecting all version…3.7
• CVE-2022-33750CA Automic Automation 12.2 and 12.3 contain an authenticatio…9.8
• CVE-2022-33751CA Automic Automation 12.2 and 12.3 contain an insecure memo…7.5
• CVE-2022-33752CA Automic Automation 12.2 and 12.3 contain an insufficient …9.8
• CVE-2022-33753CA Automic Automation 12.2 and 12.3 contain an insecure file…8.8