Log in Start free

Vulnerability · Published Nov 1, 2022 · Assigned by XEN

CVE-2022-42319

Medium 6.5

In plain English

A medium-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.3%top 77.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only after the request has been finished completely. A request is regarded to be finished only after the guest has read the response message of the request from the ring page. Thus a guest not reading the response can cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of Service (DoS) of xenstored.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xen4.17.0-r0ALPINE-CVE-2022-42319
Alpine:v3.21xen4.17.0-r0ALPINE-CVE-2022-42319
Alpine:v3.22xen4.17.0-r0ALPINE-CVE-2022-42319
Alpine:v3.23xen4.17.0-r0ALPINE-CVE-2022-42319
Alpine:v3.24xen4.17.0-r0ALPINE-CVE-2022-42319
Debian:12xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-42319
Debian:13xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-42319
Debian:14xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-42319
Ubuntu:22.04:LTSxenno fix listedUBUNTU-CVE-2022-42319
Ubuntu:24.04:LTSxenno fix listedUBUNTU-CVE-2022-42319
Ubuntu:25.10xenno fix listedUBUNTU-CVE-2022-42319
Ubuntu:26.04:LTSxenno fix listedUBUNTU-CVE-2022-42319
Ubuntu:26.10xenno fix listedUBUNTU-CVE-2022-42319

Affected products (as reported)

VendorProductVersions
Xen xen see references

References