Log in Start free

Vulnerability · Published Nov 1, 2022 · Assigned by XEN

CVE-2022-42325

Medium 5.5

In plain English

A medium-severity security flaw in xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20xen4.17.0-r0ALPINE-CVE-2022-42325
Alpine:v3.21xen4.17.0-r0ALPINE-CVE-2022-42325
Alpine:v3.22xen4.17.0-r0ALPINE-CVE-2022-42325
Alpine:v3.23xen4.17.0-r0ALPINE-CVE-2022-42325
Alpine:v3.24xen4.17.0-r0ALPINE-CVE-2022-42325
Debian:12xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-42325
Debian:13xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-42325
Debian:14xen4.16.2+90-g0d39a6d1ae-1DEBIAN-CVE-2022-42325
Ubuntu:22.04:LTSxenno fix listedUBUNTU-CVE-2022-42325
Ubuntu:24.04:LTSxenno fix listedUBUNTU-CVE-2022-42325
Ubuntu:25.10xenno fix listedUBUNTU-CVE-2022-42325
Ubuntu:26.04:LTSxenno fix listedUBUNTU-CVE-2022-42325
Ubuntu:26.10xenno fix listedUBUNTU-CVE-2022-42325

Affected products (as reported)

VendorProductVersions
Xen xen see references

References