CVE-2022-42320

published 2022-11-01

CVE-2022-42320: Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be…

Priority P4 31 high 7 CVSS 3.1

AV L AC H PR L UI N S U C H I H A H

Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the domid of the removed domain. This is normally no problem, as those access right entries will be corrected when such a node is written later. There is a small time window when a new domain is created, where the access rights of a past domain with the same domid as the new one will be regarded to be still valid, leading to the new domain being able to get access to a node which was meant to be accessible by the removed domain. For this to happen another domain needs to write the node before the newly created domain is being introduced to Xenstore by dom0.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	xen	< xen 4.16.2+90-g0d39a6d1ae-1 (bookworm)	xen 4.16.2+90-g0d39a6d1ae-1 (bookworm)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
xen	xen	>= 0 < 4.14.5+86-g1c354767d5-1	4.14.5+86-g1c354767d5-1
xen	xen	>= 0 < 4.16.2+90-g0d39a6d1ae-1	4.16.2+90-g0d39a6d1ae-1
xen	xen	>= 0 < 4.16.2+90-g0d39a6d1ae-1	4.16.2+90-g0d39a6d1ae-1
xen	xen	>= 0 < 4.16.2+90-g0d39a6d1ae-1	4.16.2+90-g0d39a6d1ae-1

CVSS provenance

nvd v3.1 7.0 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.0 HIGH

vendor_debian 7.0 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-459