CVE-2022-42309

2022-11-0113:15:11

CWE-763

[email protected]

web.nvd.nist.gov

xenstore

crash

bug

guest

security

nvd

cve-2022-42309

8.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.

Affected configurations

NVD

Node

xenxenMatch-

Node

debiandebian_linuxMatch11.0

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

CPENameOperatorVersion
xen:xenxeneq-

CPE	Name	Operator	Version
xen:xen	xen	eq	-

CNA Affected

[
  {
    "vendor": "Xen",
    "product": "xen",
    "versions": [
      {
        "version": "consult Xen advisory XSA-414",
        "status": "unknown"
      }
    ]
  }
]