What is CVE-2022-42322?

CVE-2022-42322 is a medium-severity vulnerability in Xen, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2022-11-01.

How severe is CVE-2022-42322?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Xen

CVE-2022-42322

Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by Xenstore quota.

Published 2022-11-01 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.003 (19.4th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 19.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Xen — versions consult Xen advisory XSA-419
Debian Linux — versions 11.0
Fedoraproject Fedora — versions 35, 36, 37

Weakness classification (CWE)

CWE-401 — Missing Release of Memory after Effective Lifetime

References

xenbits.xenproject.org/xsa/advisory-419.txt (Patch, Vendor Advisory)
xenbits.xen.org/xsa/advisory-419.html (Patch, Vendor Advisory)
www.openwall.com/lists/oss-security/2022/11/01/9 (mailing-list, Patch, Mailing List, Third Party Advisory)
www.debian.org/security/2022/dsa-5272 (vendor-advisory, Third Party Advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
security.gentoo.org/glsa/202402-07 (vendor-advisory)

Frequently asked questions

What is CVE-2022-42322?: CVE-2022-42322 is a medium-severity vulnerability in Xen, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2022-11-01.
How severe is CVE-2022-42322?: Medium severity. CVSS v3 base score is 5.5 out of 10.