Resource management error in Xen - CVE-2022-42312

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU70591

Resource management error in Xen - CVE-2022-42312

Published: January 2, 2023


Vulnerability identifier: #VU70591
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H]
CVE-ID: CVE-2022-42312
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the Xenstore. A malicious guest can allocate huge amount of memory and perform a denial of service (DoS) attack.


Affected software

Xen
Oracle VM Server for x86
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
Fedora
xen-libs-32bit
xen-doc-html
xen-debugsource
xen
xen-libs
xen-libs-debuginfo-32bit
xen-libs-debuginfo
xen-tools
xen-tools-debuginfo
xen-tools-domU
xen-tools-domU-debuginfo
xen-devel
xen-tools-xendomains-wait-disk

How to mitigate CVE-2022-42312

Install updates from vendor's website.

xen-libs-32bit - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1
xen-doc-html - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1
xen-debugsource - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.10.4_40-150000.3.84.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.10.4_40-150000.3.84.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen-libs - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.10.4_40-150000.3.84.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen-libs-debuginfo-32bit - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1
xen-libs-debuginfo - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.10.4_40-150000.3.84.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen-tools - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.10.4_40-150000.3.84.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen-tools-debuginfo - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.10.4_40-150000.3.84.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen-tools-domU - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.10.4_40-150000.3.84.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen-tools-domU-debuginfo - addressed in versions 4.7.6_28-43.98.1, 4.9.4_34-3.114.1, 4.10.4_40-150000.3.84.1, 4.11.4_34-2.83.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen-devel - addressed in versions 4.10.4_40-150000.3.84.1, 4.12.4_30-3.82.1, 4.12.4_30-150100.3.80.1, 4.13.4_16-150200.3.65.1
xen-tools-xendomains-wait-disk - update to 4.13.4_16-150200.3.65.1
xen - addressed in versions 4.16.2-3.fc36, 4.16.2-3.fc37, 4.16.2-4.fc37

External References

Related Security Bulletins