Stanislav Uschakow

**Name of the Vulnerable Software and Affected Versions** C Xenstored (affected versions not specified) **Description** When a transaction is committed, C Xenstored checks the quota is correct before attempting to commit any nodes. It is possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored assume that the quota cannot be negative and use assert() to confirm it, leading to a crash when tools are built without -DNDEBUG (this is the default). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.