Vulnerability in Xen
CVE-2022-42310
Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.003 (18.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 18.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Xen — versions consult Xen advisory XSA-415
- Debian Linux — versions 11.0
- Fedoraproject Fedora — versions 35, 36, 37
Weakness classification (CWE)
References
- xenbits.xenproject.org/xsa/advisory-415.txt (Third Party Advisory)
- xenbits.xen.org/xsa/advisory-415.html (Patch, Third Party Advisory)
- www.openwall.com/lists/oss-security/2022/11/01/5 (mailing-list, Mailing List, Third Party Advisory)
- www.debian.org/security/2022/dsa-5272 (vendor-advisory, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- security.gentoo.org/glsa/202402-07 (vendor-advisory)
Frequently asked questions
- What is CVE-2022-42310?
- CVE-2022-42310 is a medium-severity vulnerability in Xen, classified under Incomplete Cleanup. CVSS score: 5.5/10. Published 2022-11-01.
- How severe is CVE-2022-42310?
- Medium severity. CVSS v3 base score is 5.5 out of 10.