Vulnerability Description
Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xen | Xen | >= 4.9.0, < 4.13.0 |
| Debian | Debian Linux | 11.0 |
| Fedoraproject | Fedora | 35 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/11/01/5Mailing ListThird Party Advisory
- http://xenbits.xen.org/xsa/advisory-415.htmlPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202402-07
- https://www.debian.org/security/2022/dsa-5272Third Party Advisory
- https://xenbits.xenproject.org/xsa/advisory-415.txtThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/01/5Mailing ListThird Party Advisory
- http://xenbits.xen.org/xsa/advisory-415.htmlPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202402-07
- https://www.debian.org/security/2022/dsa-5272Third Party Advisory
FAQ
What is CVE-2022-42310?
CVE-2022-42310 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the...
How severe is CVE-2022-42310?
CVE-2022-42310 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-42310?
Check the references section above for vendor advisories and patch information. Affected products include: Xen Xen, Debian Debian Linux, Fedoraproject Fedora.