PT-2022-7335 · Xenstore+1 · Xenstore+1

Julien Grall · Published 2022-11-01 · Updated 2024-02-04 · CVE-2022-42309

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xenstore (affected versions not specified)

Description The issue is related to a bug in the fix of XSA-115, where a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path. This can result in a crash of xenstored or a memory corruption in xenstored, causing further damage. The error path can be controlled by the guest, for example, by exceeding the quota value of maximum nodes per domain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-763

Related Identifiers

BDU:2024-03591

CVE-2022-42309

DSA-5272-1

OPENSUSE-SU-2022_3947-1

OPENSUSE-SU-2022_4007-1

SUSE-SU-2022:3925-1

SUSE-SU-2022:3928-1

SUSE-SU-2022:3947-1

SUSE-SU-2022:3960-1

SUSE-SU-2022:3971-1

SUSE-SU-2022:4007-1

SUSE-SU-2022:4051-1

SUSE-SU-2022:4241-1

SUSE-SU-2022:4332-1

SUSE-SU-2022_3960-1

SUSE-SU-2022_4332-1

Affected Products

Suse

Xenstore

References · 88

• https://xenbits.xenproject.org/xsa/advisory-414.txt · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4007-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3960-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3928-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5272 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4332-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-42309 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3925-1 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-414.html · Vendor Advisory
• https://security.gentoo.org/glsa/202402-07 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-42309 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-42309 · Vendor Advisory