PT-2022-7324 · Xenstore+1 · Xenstore+1

Jürgen Groß · Published 2022-11-01 · Updated 2024-02-04 · CVE-2022-42322

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xenstore (affected versions not specified)

Description The issue allows cooperating guests to create an arbitrary number of Xenstore nodes. This is possible when one guest lets another write into its local Xenstore tree, creating many nodes and then rebooting. The nodes created will be owned by Dom0, which has no limit on the number of nodes it can own due to Xenstore quota. This can lead to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2024-03580

CVE-2022-42322

DSA-5272-1

OPENSUSE-SU-2022_3947-1

OPENSUSE-SU-2022_4007-1

SUSE-SU-2022:3925-1

SUSE-SU-2022:3928-1

SUSE-SU-2022:3947-1

SUSE-SU-2022:3960-1

SUSE-SU-2022:3971-1

SUSE-SU-2022:4007-1

SUSE-SU-2022:4051-1

SUSE-SU-2022:4241-1

SUSE-SU-2022:4332-1

Affected Products

Suse

Xenstore

References · 86

• https://osv.dev/vulnerability/SUSE-SU-2022:4007-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3960-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-42322 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-42322 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3928-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03580 · Security Note
• https://debian.org/security/2022/dsa-5272 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4332-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3925-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-42322 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-42322 · Vendor Advisory
• https://security.gentoo.org/glsa/202402-07 · Vendor Advisory