PT-2022-7319 · Xenstore+1 · Xenstore+1

Julien Grall · Published 2022-11-01 · Updated 2024-02-04 · CVE-2022-42325

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xenstore (affected versions not specified)

Description The issue allows guests to create an arbitrary number of nodes via transactions. If a node is created in a transaction and later deleted in the same transaction, the transaction will be terminated with an error. This error occurs when handling the deleted node at transaction finalization, resulting in the transaction being performed partially without updating the accounting information. A malicious guest can exploit this to create an arbitrary number of nodes. The vulnerability is related to errors in memory release due to the creation of an arbitrary number of nodes through transactions, which can lead to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2024-03575

CVE-2022-42325

DSA-5272-1

OPENSUSE-SU-2022_3947-1

OPENSUSE-SU-2022_4007-1

SUSE-SU-2022:3925-1

SUSE-SU-2022:3928-1

SUSE-SU-2022:3947-1

SUSE-SU-2022:3960-1

SUSE-SU-2022:3971-1

SUSE-SU-2022:4007-1

SUSE-SU-2022:4241-1

SUSE-SU-2022:4332-1

Affected Products

Suse

Xenstore

References · 84

• https://xenbits.xenproject.org/xsa/advisory-421.txt · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-42325 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4007-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3960-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3928-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03575 · Security Note
• https://debian.org/security/2022/dsa-5272 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4332-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-42325 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3925-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202402-07 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-421.html · Vendor Advisory