Xenstore Vulnerability in Xen Project Can Cause Crashes Due to Node Creation Error
CVE-2022-42309

8.8HIGH

Key Information:

Vendor

Xen Project
Status
Xen
Vendor
CVE Published:
1 November 2022

What is CVE-2022-42309?

A vulnerability in Xenstore has been identified that allows malicious guest domains to exploit a flaw in node creation error handling. When a guest exceeds the maximum node quota, it can trigger a condition leading to the use of an incorrect pointer in xenstored, potentially causing not only a crash of the service but also memory corruption. This can result in further instability and damage within the system, necessitating urgent attention from administrators to mitigate potential risks.

Affected Version(s)

xen consult Xen advisory XSA-414

References

https://xenbits.xenproject.org/xsa/advisory-414.txt
http://xenbits.xen.org/xsa/advisory-414.html
http://www.openwall.com/lists/oss-security/2022/11/01/4
mailing-list

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

{'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'This issue was discovered by Julien Grall of Amazon.'}]}}}
.
CVE-2022-42309 : Xenstore Vulnerability in Xen Project Can Cause Crashes Due to Node Creation Error