CVE-2022-42326
Summary
| CVE | CVE-2022-42326 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-11-01 13:15:00 UTC |
|---|
| Updated | 2024-02-04 08:15:00 UTC |
|---|
| Description | Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 37 Update: xen-4.16.2-4.fc37 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Xen: Multiple Vulnerabilities (GLSA 202402-07) — Gentoo security |
|
security.gentoo.org |
|
| xenbits.xenproject.org/xsa/advisory-421.txt |
MISC |
xenbits.xenproject.org |
|
| [SECURITY] Fedora 37 Update: xen-4.16.2-4.fc37 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| oss-security - Xen Security Advisory 421 v2 (CVE-2022-42325,CVE-2022-42326) -
Xenstore: Guests can create arbitrary number of nodes via transactions |
MLIST |
www.openwall.com |
|
| Debian -- Security Information -- DSA-5272-1 xen |
DEBIAN |
www.debian.org |
|
| [SECURITY] Fedora 36 Update: xen-4.16.2-3.fc36 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 36 Update: xen-4.16.2-3.fc36 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| XSA-421 - Xen Security Advisories |
CONFIRM |
xenbits.xen.org |
|
| [SECURITY] Fedora 35 Update: xen-4.15.3-7.fc35 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 35 Update: xen-4.15.3-7.fc35 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Array
Legacy QID Mappings
- 181193 Debian Security Update for xen (DSA 5272-1)
- 184258 Debian Security Update for xen (CVE-2022-42326)
- 283293 Fedora Security Update for xen (FEDORA-2022-07438e12df)
- 283319 Fedora Security Update for xen (FEDORA-2022-99af00f60e)
- 283430 Fedora Security Update for xen (FEDORA-2022-9f51d13fa3)
- 390275 Oracle Managed Virtualization (VM) Server for x86 Security Update for xen (OVMSA-2023-0005)
- 502600 Alpine Linux Security Update for xen
- 502619 Alpine Linux Security Update for xen
- 503143 Alpine Linux Security Update for xen
- 503695 Alpine Linux Security Update for xen
- 504549 Alpine Linux Security Update for xen
- 505964 Alpine Linux Security Update for xen
- 710858 Gentoo Linux Xen Multiple Vulnerabilities (GLSA 202402-07)
- 752778 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3925-1)
- 752781 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3928-1)
- 752792 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3947-1)
- 752796 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3971-1)
- 752807 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:4007-1)
- 752887 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:4241-1)
- 752979 SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:4332-1)
