PT-2022-7332 · Xenstore+1 · Xenstore+1

Julien Grall · Published 2022-11-01 · Updated 2025-05-05 · CVE-2022-42326

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xenstore (affected versions not specified)

Description The issue is related to errors in memory release due to the creation of an arbitrary number of nodes via transactions. This can enable a malicious guest to create an arbitrary number of nodes, potentially leading to a denial of service. When a node is created in a transaction and later deleted in the same transaction, the transaction will be terminated with an error. This error occurs only when handling the deleted node at transaction finalization, resulting in the transaction being performed partially without updating the accounting information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2024-03588

CVE-2022-42326

DSA-5272-1

OPENSUSE-SU-2022_3947-1

OPENSUSE-SU-2022_4007-1

SUSE-SU-2022:3925-1

SUSE-SU-2022:3928-1

SUSE-SU-2022:3947-1

SUSE-SU-2022:3960-1

SUSE-SU-2022:3971-1

SUSE-SU-2022:4007-1

SUSE-SU-2022:4241-1

SUSE-SU-2022:4332-1

Affected Products

Suse

Xenstore

References · 86

• https://bdu.fstec.ru/vul/2024-03588 · Security Note
• https://ubuntu.com/security/CVE-2022-42326 · Vendor Advisory
• https://xenbits.xenproject.org/xsa/advisory-421.txt · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4007-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3960-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3928-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5272 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4332-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-42326 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3925-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-42326 · Vendor Advisory
• https://security.gentoo.org/glsa/202402-07 · Vendor Advisory