CVE-2022-42321: Medium severity XEN Xen vulnerability
Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.14.6-1Fixed in 4.14.5+94-ge49571868d-1Fixed in 4.17.1+2-gb773c48e36-1Fixed in 4.17.2+55-g0b56bed864-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-42321?
The severity of CVE-2022-42321 is medium.
How can guests crash xenstored using CVE-2022-42321?
Guests can crash xenstored by exhausting the stack through recursion, specifically when deleting a sub-tree of Xenstore nodes.
Which versions of xen are affected by CVE-2022-42321?
Versions 4.14.6-1, 4.14.5+94-ge49571868d-1, 4.17.1+2-gb773c48e36-1, and 4.17.2+55-g0b56bed864-1 are affected by CVE-2022-42321.
Which software packages are affected by CVE-2022-42321?
Debian Xen, Xen Xen, Debian Debian Linux, Fedoraproject Fedora 35, Fedoraproject Fedora 36, and Fedoraproject Fedora 37 are affected by CVE-2022-42321.
How can I fix CVE-2022-42321?
To fix CVE-2022-42321, update your Xen software to versions 4.14.6-1, 4.14.5+94-ge49571868d-1, 4.17.1+2-gb773c48e36-1, or 4.17.2+55-g0b56bed864-1.