Denial of service in Xen Linux netback driver

Published: 2022-12-21

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-42328 CVE-2022-42329
CWE-ID	CWE-399
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Xen Server applications / Virtualization software
Vendor	Xen Project

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU70469

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-42328

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources. An attacker with access to the guest OS can trigger deadlock in Linux netback driver and perform a denial of service (DoS) attack of the host via the paravirtualized network interface.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Xen: All versions

External links

http://xenbits.xenproject.org/xsa/advisory-424.txt
http://www.openwall.com/lists/oss-security/2022/12/08/3
http://www.openwall.com/lists/oss-security/2022/12/08/2
http://www.openwall.com/lists/oss-security/2022/12/09/2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource management error

EUVDB-ID: #VU70470