gsd-2022-42309
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.
Aliases
Aliases
CVE-2022-42309


To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-42309",
    "description": "Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.",
    "id": "GSD-2022-42309",
    "references": [
      "https://www.debian.org/security/2022/dsa-5272",
      "https://www.suse.com/security/cve/CVE-2022-42309.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-42309"
      ],
      "details": "Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.",
      "id": "GSD-2022-42309",
      "modified": "2023-12-13T01:19:10.397991Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@xen.org",
        "ID": "CVE-2022-42309",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "xen",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "?",
                          "version_value": "consult Xen advisory XSA-414"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Xen"
            }
          ]
        }
      },
      "configuration": {
        "configuration_data": {
          "description": {
            "description_data": [
              {
                "lang": "eng",
                "value": "All Xen versions with the fix for XSA-115 running the C variant of Xenstore\n(xenstored or xenstore-stubdom) are vulnerable.\n\nSystems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable."
              }
            ]
          }
        }
      },
      "credit": {
        "credit_data": {
          "description": {
            "description_data": [
              {
                "lang": "eng",
                "value": "This issue was discovered by Julien Grall of Amazon."
              }
            ]
          }
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain."
          }
        ]
      },
      "impact": {
        "impact_data": {
          "description": {
            "description_data": [
              {
                "lang": "eng",
                "value": "A malicious guest can cause xenstored to crash, resulting in the inability\nto create new guests or to change the configuration of running guests.\n\nMemory corruption in xenstored or privilege escalation of a guest can\u0027t\nbe ruled out."
              }
            ]
          }
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "unknown"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://xenbits.xenproject.org/xsa/advisory-414.txt",
            "refsource": "MISC",
            "url": "https://xenbits.xenproject.org/xsa/advisory-414.txt"
          },
          {
            "name": "http://xenbits.xen.org/xsa/advisory-414.html",
            "refsource": "CONFIRM",
            "url": "http://xenbits.xen.org/xsa/advisory-414.html"
          },
          {
            "name": "[oss-security] 20221101 Xen Security Advisory 414 v2 (CVE-2022-42309) - Xenstore: Guests can crash xenstored",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2022/11/01/4"
          },
          {
            "name": "DSA-5272",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2022/dsa-5272"
          },
          {
            "name": "FEDORA-2022-07438e12df",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"
          },
          {
            "name": "FEDORA-2022-99af00f60e",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"
          },
          {
            "name": "FEDORA-2022-9f51d13fa3",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
          },
          {
            "name": "GLSA-202402-07",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202402-07"
          }
        ]
      },
      "workaround": {
        "workaround_data": {
          "description": {
            "description_data": [
              {
                "lang": "eng",
                "value": "Using oxenstored instead of xenstored will avoid the vulnerability."
              }
            ]
          }
        }
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:xen:xen:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BFA1950D-1D9F-4401-AA86-CF3028EFD286",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain."
          },
          {
            "lang": "es",
            "value": "Xenstore: Los invitados pueden bloquear xenstored Debido a un error en la soluci\u00f3n de XSA-115, un invitado malintencionado puede hacer que xenstored use un puntero incorrecto durante la creaci\u00f3n del nodo en una ruta de error, lo que resulta en una falla de xenstored o una corrupci\u00f3n de la memoria en xenstored, lo que provoca m\u00e1s da\u00f1o. El invitado puede controlar el ingreso de la ruta de error, por ejemplo, excediendo el valor de cuota de nodos m\u00e1ximos por dominio."
          }
        ],
        "id": "CVE-2022-42309",
        "lastModified": "2024-02-04T08:15:11.987",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-11-01T13:15:11.237",
        "references": [
          {
            "source": "security@xen.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/11/01/4"
          },
          {
            "source": "security@xen.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-414.html"
          },
          {
            "source": "security@xen.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
          },
          {
            "source": "security@xen.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"
          },
          {
            "source": "security@xen.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"
          },
          {
            "source": "security@xen.org",
            "url": "https://security.gentoo.org/glsa/202402-07"
          },
          {
            "source": "security@xen.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5272"
          },
          {
            "source": "security@xen.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://xenbits.xenproject.org/xsa/advisory-414.txt"
          }
        ],
        "sourceIdentifier": "security@xen.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-763"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.