Xenstore Vulnerability in Xen Project Can Cause Crashes Due to Node Creation Error
CVE-2022-42309

8.8HIGH

Key Information:

Vendor

Xen Project
Status
Xen
Vendor
CVE Published:
1 November 2022

What is CVE-2022-42309?

A vulnerability in Xenstore has been identified that allows malicious guest domains to exploit a flaw in node creation error handling. When a guest exceeds the maximum node quota, it can trigger a condition leading to the use of an incorrect pointer in xenstored, potentially causing not only a crash of the service but also memory corruption. This can result in further instability and damage within the system, necessitating urgent attention from administrators to mitigate potential risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

xen consult Xen advisory XSA-414

References

https://xenbits.xenproject.org/xsa/advisory-414.txt
http://xenbits.xen.org/xsa/advisory-414.html
http://www.openwall.com/lists/oss-security/2022/11/01/4
mailing-list

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Julien Grall of Amazon.'}]}}}
JSON
.