CVE-2022-42322
Quick assessment
Affected
Xen xen
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Xen是英国剑桥（Cambridge）大学的一款开源的虚拟机监视器产品。该产品能够使不同和不兼容的操作系统运行在同一台计算机上，并支持在运行时进行迁移，保证正常运行并且避免宕机。 Xen Xenstore存在安全漏洞，该漏洞源于两个恶意访客可以一起创建任意数量的节点，可能会导致内存不足，从而导致拒绝服务(DoS)。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-42322
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by Xenstore quota.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Xen 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Xen是英国剑桥（Cambridge）大学的一款开源的虚拟机监视器产品。该产品能够使不同和不兼容的操作系统运行在同一台计算机上，并支持在运行时进行迁移，保证正常运行并且避免宕机。 Xen Xenstore存在安全漏洞，该漏洞源于两个恶意访客可以一起创建任意数量的节点，可能会导致内存不足，从而导致拒绝服务(DoS)。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-42322
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-42322
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-42322 (2)
-
https://www.debian.org/security/2022/dsa-5272 vendor-advisory
-
https://security.gentoo.org/glsa/202402-07 vendor-advisory
Mailing List Discussions for CVE-2022-42322 (4)
Other References for CVE-2022-42322 (2)
Same Patch Batch · Xen · 2022-11-01 · 19 CVEs total
| CVE-2022-42318 | Xen 安全漏洞 | |
| CVE-2022-42327 | Xen 安全漏洞 | |
| CVE-2022-42326 | Xen 安全漏洞 | |
| CVE-2022-42325 | Xen 安全漏洞 | |
| CVE-2022-42324 | Xen 缓冲区错误漏洞 | |
| CVE-2022-42323 | Xen 安全漏洞 | |
| CVE-2022-42321 | Xen 安全漏洞 | |
| CVE-2022-42320 | Xen 安全漏洞 | |
| CVE-2022-42319 | Xen 安全漏洞 | |
| CVE-2022-42309 | Xen 安全漏洞 | |
| CVE-2022-42317 | Xen 安全漏洞 | |
| CVE-2022-42316 | Xen 安全漏洞 | |
| CVE-2022-42315 | Xen 安全漏洞 | |
| CVE-2022-42314 | Xen 安全漏洞 | |
| CVE-2022-42313 | Xen 安全漏洞 | |
| CVE-2022-42312 | Xen 安全漏洞 | |
| CVE-2022-42311 | Xen 安全漏洞 | |
| CVE-2022-42310 | Xen 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2022-42322
No comments yet