[Forgot Password]
Login  Register Subscribe

30481

 
 

423868

 
 

255116

 
 

909

 
 

198683

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2022-42318Date: (C)2022-11-04   (M)2024-02-09


Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 6.5CVSS Score :
Exploit Score: 2.0Exploit Score:
Impact Score: 4.0Impact Score:
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: LOCALAccess Vector:
Attack Complexity: LOWAccess Complexity:
Privileges Required: LOWAuthentication:
User Interaction: NONEConfidentiality:
Scope: CHANGEDIntegrity:
Confidentiality: NONEAvailability:
Integrity: NONE 
Availability: HIGH 
  
Reference:
DSA-5272
FEDORA-2022-07438e12df
FEDORA-2022-99af00f60e
FEDORA-2022-9f51d13fa3
http://xenbits.xen.org/xsa/advisory-326.html
https://xenbits.xenproject.org/xsa/advisory-326.txt

CPE    1
cpe:/o:xen:xen:-
CWE    1
CWE-770
OVAL    14
oval:org.secpod.oval:def:610240
oval:org.secpod.oval:def:3300719
oval:org.secpod.oval:def:89047969
oval:org.secpod.oval:def:89047889
...

© SecPod Technologies