{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-42330", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "assignerShortName": "XEN", "dateUpdated": "2024-02-04T08:07:26.439593", "dateReserved": "2022-10-03T00:00:00", "datePublished": "2023-01-26T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2024-02-04T08:07:26.439593"}, "descriptions": [{"lang": "en", "value": "Guests can cause Xenstore crash via soft reset When a guest issues a \"Soft Reset\" (e.g. for performing a kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same impact."}], "affected": [{"vendor": "Xen", "product": "xen", "versions": [{"version": "consult Xen advisory XSA-425", "status": "unknown"}]}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-425.txt"}, {"name": "GLSA-202402-07", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202402-07"}], "metrics": [{"other": {"type": "unknown", "content": {"description": {"description_data": [{"lang": "eng", "value": "A malicious guest could try to kexec until it hits the xenstored bug,\nresulting in the inability to perform any further domain administration\nlike starting new guests, or adding/removing resources to or from any\nexisting guest."}]}}}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "unknown"}]}]}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:4.17.0:*:*:*:*:*:x64:*", "matchCriteriaId": "7F641815-8FA3-4815-A02F-5D674214D7FC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Guests can cause Xenstore crash via soft reset When a guest issues a \"Soft Reset\" (e.g. for performing a kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same impact."}, {"lang": "es", "value": "Los invitados pueden provocar un fallo de Xenstore mediante un reinicio por software Cuando un invitado emite un \"Reinicio por software\" (por ejemplo, para realizar un kexec), la pila de herramientas de Xen basada en libxl normalmente realizar\u00e1 una operaci\u00f3n XS_RELEASE de Xenstore. Debido a un error en xenstored, esto puede provocar un fallo de xenstored. Cualquier otro uso de XS_RELEASE tendr\u00e1 el mismo impacto."}], "id": "CVE-2022-42330", "lastModified": "2024-02-04T08:15:13.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-26T21:16:47.947", "references": [{"source": "security@xen.org", "url": "https://security.gentoo.org/glsa/202402-07"}, {"source": "security@xen.org", "tags": ["Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-425.txt"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}