CVE-2022-42309

Katalog CVE

CVSS 8.8 · High EPSS 0,29%

Kerentanan Release of Invalid Pointer or Reference pada xen, debian linux +1 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.

Rincian

Terbit di NVD

1 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-763: Release of Invalid Pointer or Reference

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://xenbits.xen.org/xsa/advisory-414.html patch · advisory vendor
• https://xenbits.xenproject.org/xsa/advisory-414.txt patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/11/01/4 mailing list · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5272 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MS...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJ...
• https://security.gentoo.org/glsa/202402-07