{"api_version":"1","generated_at":"2026-04-22T23:53:33+00:00","cve":"CVE-2022-42310","urls":{"html":"https://cve.report/CVE-2022-42310","api":"https://cve.report/api/cve/CVE-2022-42310.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-42310","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-42310"},"summary":{"title":"CVE-2022-42310","description":"Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.","state":"PUBLIC","assigner":"security@xen.org","published_at":"2022-11-01 13:15:00","updated_at":"2024-02-04 08:15:00"},"problem_types":["CWE-459"],"metrics":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2022/11/01/5","name":"[oss-security] 20221101 Xen Security Advisory 415 v2 (CVE-2022-42310) - Xenstore: Guests can create orphaned Xenstore nodes","refsource":"MLIST","tags":[],"title":"oss-security - Xen Security Advisory 415 v2 (CVE-2022-42310) - Xenstore: Guests\n can create orphaned Xenstore nodes","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/","name":"FEDORA-2022-9f51d13fa3","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 37 Update: xen-4.16.2-4.fc37 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://xenbits.xenproject.org/xsa/advisory-415.txt","name":"https://xenbits.xenproject.org/xsa/advisory-415.txt","refsource":"MISC","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"404"},{"url":"https://security.gentoo.org/glsa/202402-07","name":"GLSA-202402-07","refsource":"","tags":[],"title":"Xen: Multiple Vulnerabilities (GLSA 202402-07) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/","name":"FEDORA-2022-9f51d13fa3","refsource":"","tags":[],"title":"[SECURITY] Fedora 37 Update: xen-4.16.2-4.fc37 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2022/dsa-5272","name":"DSA-5272","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5272-1 xen","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/","name":"FEDORA-2022-07438e12df","refsource":"","tags":[],"title":"[SECURITY] Fedora 36 Update: xen-4.16.2-3.fc36 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://xenbits.xen.org/xsa/advisory-415.html","name":"http://xenbits.xen.org/xsa/advisory-415.html","refsource":"CONFIRM","tags":[],"title":"XSA-415 - Xen Security Advisories","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/","name":"FEDORA-2022-07438e12df","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 36 Update: xen-4.16.2-3.fc36 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/","name":"FEDORA-2022-99af00f60e","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 35 Update: xen-4.15.3-7.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/","name":"FEDORA-2022-99af00f60e","refsource":"","tags":[],"title":"[SECURITY] Fedora 35 Update: xen-4.15.3-7.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42310","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42310","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Array","lang":""}],"nvd_cpes":[{"cve_year":"2022","cve_id":"42310","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"11.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"42310","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"42310","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"36","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"42310","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"37","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"42310","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"xen","cpe5":"xen","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-42310","qid":"181193","title":"Debian Security Update for xen (DSA 5272-1)"},{"cve":"CVE-2022-42310","qid":"183746","title":"Debian Security Update for xen (CVE-2022-42310)"},{"cve":"CVE-2022-42310","qid":"283293","title":"Fedora Security Update for xen (FEDORA-2022-07438e12df)"},{"cve":"CVE-2022-42310","qid":"283319","title":"Fedora Security Update for xen (FEDORA-2022-99af00f60e)"},{"cve":"CVE-2022-42310","qid":"283430","title":"Fedora Security Update for xen (FEDORA-2022-9f51d13fa3)"},{"cve":"CVE-2022-42310","qid":"390275","title":"Oracle Managed Virtualization (VM) Server for x86 Security Update for xen (OVMSA-2023-0005)"},{"cve":"CVE-2022-42310","qid":"502600","title":"Alpine Linux Security Update for xen"},{"cve":"CVE-2022-42310","qid":"502619","title":"Alpine Linux Security Update for xen"},{"cve":"CVE-2022-42310","qid":"503143","title":"Alpine Linux Security Update for xen"},{"cve":"CVE-2022-42310","qid":"503695","title":"Alpine Linux Security Update for xen"},{"cve":"CVE-2022-42310","qid":"504549","title":"Alpine Linux Security Update for xen"},{"cve":"CVE-2022-42310","qid":"505964","title":"Alpine Linux Security Update for xen"},{"cve":"CVE-2022-42310","qid":"710858","title":"Gentoo Linux Xen Multiple Vulnerabilities (GLSA 202402-07)"},{"cve":"CVE-2022-42310","qid":"752778","title":"SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3925-1)"},{"cve":"CVE-2022-42310","qid":"752781","title":"SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3928-1)"},{"cve":"CVE-2022-42310","qid":"752792","title":"SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3947-1)"},{"cve":"CVE-2022-42310","qid":"752796","title":"SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:3971-1)"},{"cve":"CVE-2022-42310","qid":"752807","title":"SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:4007-1)"},{"cve":"CVE-2022-42310","qid":"752887","title":"SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:4241-1)"},{"cve":"CVE-2022-42310","qid":"752979","title":"SUSE Enterprise Linux Security Update for xen (SUSE-SU-2022:4332-1)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@xen.org","ID":"CVE-2022-42310","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"xen","version":{"version_data":[{"version_affected":"?","version_value":"consult Xen advisory XSA-415"}]}}]},"vendor_name":"Xen"}]}},"configuration":{"configuration_data":{"description":{"description_data":[{"lang":"eng","value":"Systems with Xen version 4.9 and newer running the C variant of Xenstore\n(xenstored or xenstore-stubdom) are vulnerable.\n\nSystems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable."}]}}},"credit":{"credit_data":{"description":{"description_data":[{"lang":"eng","value":"This issue was discovered by Julien Grall of Amazon."}]}}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base."}]},"impact":{"impact_data":{"description":{"description_data":[{"lang":"eng","value":"A malicious guest can cause inconsistencies in the xenstored data base,\nresulting in unusual error responses or memory leaks in xenstored. This\ncan finally cause Denial of Service situations or long running error\nrecoveries of xenstored."}]}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"unknown"}]}]},"references":{"reference_data":[{"url":"https://xenbits.xenproject.org/xsa/advisory-415.txt","refsource":"MISC","name":"https://xenbits.xenproject.org/xsa/advisory-415.txt"},{"refsource":"CONFIRM","name":"http://xenbits.xen.org/xsa/advisory-415.html","url":"http://xenbits.xen.org/xsa/advisory-415.html"},{"refsource":"MLIST","name":"[oss-security] 20221101 Xen Security Advisory 415 v2 (CVE-2022-42310) - Xenstore: Guests can create orphaned Xenstore nodes","url":"http://www.openwall.com/lists/oss-security/2022/11/01/5"},{"refsource":"DEBIAN","name":"DSA-5272","url":"https://www.debian.org/security/2022/dsa-5272"},{"refsource":"FEDORA","name":"FEDORA-2022-07438e12df","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"},{"refsource":"FEDORA","name":"FEDORA-2022-99af00f60e","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"},{"refsource":"FEDORA","name":"FEDORA-2022-9f51d13fa3","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"}]},"workaround":{"workaround_data":{"description":{"description_data":[{"lang":"eng","value":"Using oxenstored will avoid the vulnerability."}]}}}},"nvd":{"publishedDate":"2022-11-01 13:15:00","lastModifiedDate":"2024-02-04 08:15:00","problem_types":["CWE-459"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.8,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.0","versionEndExcluding":"4.13.0","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}