Vulnerability in Xen
CVE-2022-42310
Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.
EPSS: 0.003 (18.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Xen — versions consult Xen advisory XSA-415
- Debian Debian_linux — versions 11.0
- Fedoraproject Fedora — versions 35, 36, 37
Weakness classification (CWE)
References
- security@xen.org (Third Party Advisory)
- security@xen.org (Patch, Third Party Advisory)
- security@xen.org (mailing-list, Mailing List, Third Party Advisory)
- security@xen.org (vendor-advisory, Third Party Advisory)
- security@xen.org (vendor-advisory)
- security@xen.org (vendor-advisory)
- security@xen.org (vendor-advisory)
- security@xen.org (vendor-advisory)
Frequently asked questions
- What is CVE-2022-42310?
- CVE-2022-42310 is a medium-severity vulnerability in Xen, classified under Incomplete Cleanup. CVSS score: 5.5/10. Published 2022-11-01.
- How severe is CVE-2022-42310?
- Medium severity. CVSS v3 base score is 5.5 out of 10.