CVE-2022-42309

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-42309
Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2022/11/01/4 Mailing List Third Party Advisory
http://xenbits.xen.org/xsa/advisory-414.html Patch Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
https://security.gentoo.org/glsa/202402-07
https://www.debian.org/security/2022/dsa-5272 Third Party Advisory
https://xenbits.xenproject.org/xsa/advisory-414.txt Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/11/01/4 Mailing List Third Party Advisory
http://xenbits.xen.org/xsa/advisory-414.html Patch Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
https://security.gentoo.org/glsa/202402-07
https://www.debian.org/security/2022/dsa-5272 Third Party Advisory
https://xenbits.xenproject.org/xsa/advisory-414.txt Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
History

21 Nov 2024, 07:24

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2022/11/01/4 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2022/11/01/4 - Mailing List, Third Party Advisory
References () http://xenbits.xen.org/xsa/advisory-414.html - Patch, Vendor Advisory () http://xenbits.xen.org/xsa/advisory-414.html - Patch, Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/ -
References () https://security.gentoo.org/glsa/202402-07 - () https://security.gentoo.org/glsa/202402-07 -
References () https://www.debian.org/security/2022/dsa-5272 - Third Party Advisory () https://www.debian.org/security/2022/dsa-5272 - Third Party Advisory
References () https://xenbits.xenproject.org/xsa/advisory-414.txt - Patch, Vendor Advisory () https://xenbits.xenproject.org/xsa/advisory-414.txt - Patch, Vendor Advisory

04 Feb 2024, 08:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202402-07 -

07 Nov 2023, 03:53

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/', 'name': 'FEDORA-2022-9f51d13fa3', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/', 'name': 'FEDORA-2022-99af00f60e', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/', 'name': 'FEDORA-2022-07438e12df', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/ -
Information

Published : 2022-11-01 13:15

Updated : 2024-11-21 07:24

NVD link : CVE-2022-42309

Mitre link : CVE-2022-42309

CVE.ORG link : CVE-2022-42309

JSON object : View

Products Affected

debian

  • debian_linux

fedoraproject

  • fedora

xen

  • xen
CWE
CWE-763

Release of Invalid Pointer or Reference