CVE-2022-42310

Aliases:DEBIAN-CVE-2022-42310ALPINE-CVE-2022-42310
Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 01 Nov 2022, 00:00
Last modified:03 Aug 2024, 13:03

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v3.1 (nvd)
EPSS Score
0.28% LOW
0% probability +0.25%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Nov 2022, 00:00
Published
Vulnerability first disclosed
03 Aug 2024, 13:03
Last Modified
Vulnerability information updated

Description

Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.28%• Percentile: 20%

Techniques & Countermeasures

  • CWE-459•Incomplete Cleanup

    The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Affected Systems

  • alpine•xen

    ≥ 4.9.0, < 4.15.4-r0 | ≥ 4.9.0, < 4.15.4-r0 | ≥ 4.9.0, < 4.16.3-r0 | ≥ 4.9.0, < 4.16.3-r0 | ≥ 4.9.0, < 4.17.0-r0 | ≥ 4.9.0, < 4.17.0-r0 | ≥ 4.9.0, < 4.17.0-r0 | ≥ 4.9.0, < 4.17.0-r0 | ≥ 4.9.0, < 4.17.0-r0 | ≥ 4.9.0, < 4.17.0-r0 | ≥ 4.9.0, < 4.17.0-r0

  • debian•xen

    < 4.14.5+86-g1c354767d5-1 | < 4.16.2+90-g0d39a6d1ae-1 | < 4.16.2+90-g0d39a6d1ae-1 | < 4.16.2+90-g0d39a6d1ae-1

  • debian•debian_linux

    11.0

  • fedoraproject•fedora

    35 | 36 | 37

  • xen•xen

    ≥ 4.9.0, < 4.13.0

References (10)