CVE-2022-42310: Medium severity XEN Xen vulnerability
Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.14.6-1Fixed in 4.14.5+94-ge49571868d-1Fixed in 4.17.1+2-gb773c48e36-1Fixed in 4.17.2+55-g0b56bed864-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-42310?
The severity of CVE-2022-42310 is medium with a severity value of 5.5.
How can a guest create orphaned Xenstore nodes using CVE-2022-42310?
By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore database.
What is the affected software for CVE-2022-42310?
The affected software includes Xen (versions 4.14.6-1, 4.14.5+94-ge49571868d-1, 4.17.1+2-gb773c48e36-1, 4.17.2+55-g0b56bed864-1) on Debian, Xen (versions 4.9.0 to 4.13.0) on Xen, Debian Linux (version 11.0) on Debian, and Fedora (versions 35, 36, 37) on Fedora.
How do I fix CVE-2022-42310 on Debian?
To fix CVE-2022-42310 on Debian, upgrade Xen to version 4.14.6-1, 4.14.5+94-ge49571868d-1, 4.17.1+2-gb773c48e36-1, or 4.17.2+55-g0b56bed864-1.
Where can I find more information about CVE-2022-42310?
You can find more information about CVE-2022-42310 at the following references: [Xenbits Xen Advisory-415](https://xenbits.xen.org/xsa/advisory-415.html), [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2022-42310), [Openwall OSS-Security Mailing List](http://www.openwall.com/lists/oss-security/2022/11/01/5).