Skip to content
Fencer Intel
medium 5.5

CVE-2022-42322 json

Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains…

published 4y ago modified 4mo ago also EUVD-2022-45397

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by Xenstore quota.

Patch / fix

  • xen Debian 14, Debian 13, Debian 12 4.16.2+90-g0d39a6d1ae-1

debian advisories DEBIAN-CVE-2022-42322

  • xen SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 4.12.4_30-3.82.1
  • xen SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 4.11.4_34-2.83.1
  • xen SLES 12 SP2-BCL 4.7.6_28-43.98.1
  • xen SLE Module for Server Applications 15 SP4, SLE Module for Basesystem 15 SP4, SLE Micro 5.3 +1 more 4.16.2_08-150400.4.16.1
  • xen SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +6 more 4.13.4_16-150200.3.65.1
  • xen SLES 12 SP3-BCL 4.9.4_34-3.114.1
  • xen SLE Module for Server Applications 15 SP3, SLE Module for Basesystem 15 SP3, SLE Micro 5.2 +3 more 4.14.5_08-150300.3.40.1
  • xen SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 4.12.4_30-150100.3.80.1

suse advisories SUSE-SU-2022:4332-1SUSE-SU-2022:4241-1SUSE-SU-2022:4051-1SUSE-SU-2022:4007-1SUSE-SU-2022:3971-1SUSE-SU-2022:3960-1

  • xen Alpine 3.15, Alpine 3.14 4.15.4-r0
  • xen Alpine 3.17, Alpine 3.16 4.16.3-r0
  • xen Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 4.17.0-r0

alpine advisories ALPINE-CVE-2022-42322

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2022-42322 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Xen xen

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.