CVE-2022-42326: Medium severity XEN Xen vulnerability
Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.14.6-1Fixed in 4.14.5+94-ge49571868d-1Fixed in 4.17.1+2-gb773c48e36-1Fixed in 4.17.2+55-g0b56bed864-1 - Compensating control
Avoid using Xenstore transactions that create a node and later delete that same node within the same transaction, because the transaction will be terminated with an error and may leave the transaction partially performed without updating accounting information.
Event History
Frequently Asked Questions
What is CVE-2022-42326?
CVE-2022-42326 is a vulnerability in Xenstore that allows guests to create an arbitrary number of nodes via transactions.
What is the severity of CVE-2022-42326?
The severity of CVE-2022-42326 is medium with a severity value of 5.5.
How does CVE-2022-42326 affect Xen Xen?
Xen Xen is affected by CVE-2022-42326 with versions from 4.9.0 onwards.
How does CVE-2022-42326 affect Debian Debian Linux?
Debian Debian Linux is affected by CVE-2022-42326 with version 11.0.
How does CVE-2022-42326 affect Fedora projects?
Fedora projects Fedora 35, 36, and 37 are affected by CVE-2022-42326.