Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-42324 (GCVE-0-2022-42324)
Vulnerability from cvelistv5 – Published: 2022-11-01 00:00 – Updated: 2024-08-03 13:03- unknown
| URL | Tags |
|---|---|
| https://xenbits.xenproject.org/xsa/advisory-420.txt | |
| http://xenbits.xen.org/xsa/advisory-420.html | |
| http://www.openwall.com/lists/oss-security/2022/1… | mailing-list |
| https://www.debian.org/security/2022/dsa-5272 | vendor-advisory |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisory |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisory |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisory |
| https://security.gentoo.org/glsa/202402-07 | vendor-advisory |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.972Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://xenbits.xenproject.org/xsa/advisory-420.txt"
},
{
"tags": [
"x_transferred"
],
"url": "http://xenbits.xen.org/xsa/advisory-420.html"
},
{
"name": "[oss-security] 20221101 Xen Security Advisory 420 v2 (CVE-2022-42324) - Oxenstored 32-\u003e31 bit integer truncation issues",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2022/11/01/10"
},
{
"name": "DSA-5272",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.debian.org/security/2022/dsa-5272"
},
{
"name": "FEDORA-2022-07438e12df",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"
},
{
"name": "FEDORA-2022-99af00f60e",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"
},
{
"name": "FEDORA-2022-9f51d13fa3",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
},
{
"name": "GLSA-202402-07",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202402-07"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-420"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "{\u0027credit_data\u0027: {\u0027description\u0027: {\u0027description_data\u0027: [{\u0027lang\u0027: \u0027eng\u0027, \u0027value\u0027: \u0027This issue was discovered by J\u00fcrgen Gro\u00df of SUSE.\u0027}]}}}"
}
],
"descriptions": [
{
"lang": "en",
"value": "Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring."
}
],
"metrics": [
{
"other": {
"content": {
"description": {
"description_data": [
{
"lang": "eng",
"value": "A malicious or buggy guest can write a packet into the xenstore ring\nwhich causes 32-bit builds of oxenstored to busy loop."
}
]
}
},
"type": "unknown"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "unknown",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-04T08:07:22.705Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-420.txt"
},
{
"url": "http://xenbits.xen.org/xsa/advisory-420.html"
},
{
"name": "[oss-security] 20221101 Xen Security Advisory 420 v2 (CVE-2022-42324) - Oxenstored 32-\u003e31 bit integer truncation issues",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2022/11/01/10"
},
{
"name": "DSA-5272",
"tags": [
"vendor-advisory"
],
"url": "https://www.debian.org/security/2022/dsa-5272"
},
{
"name": "FEDORA-2022-07438e12df",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"
},
{
"name": "FEDORA-2022-99af00f60e",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"
},
{
"name": "FEDORA-2022-9f51d13fa3",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
},
{
"name": "GLSA-202402-07",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202402-07"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2022-42324",
"datePublished": "2022-11-01T00:00:00.000Z",
"dateReserved": "2022-10-03T00:00:00.000Z",
"dateUpdated": "2024-08-03T13:03:45.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-42324",
"date": "2026-05-25",
"epss": "0.00039",
"percentile": "0.11787"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.\"}, {\"lang\": \"es\", \"value\": \"Problemas de truncado de enteros de 32 a 31 bits almacenados en Oxenstored. Los enteros en Ocaml tienen 63 o 31 bits de precisi\\u00f3n confirmada. La librer\\u00eda Ocaml Xenbus extrae una variable uint32_t de C del anillo y lo convierte directamente en un entero Ocaml. En compilaciones de Ocaml de 64 bits, esto est\\u00e1 bien, pero en compilaciones de 32 bits, trunca el bit m\\u00e1s significativo y luego crea confusi\\u00f3n sin confirmaci\\u00f3n/confirmada en el resto. Esto, a su vez, puede introducir un valor negativo en la l\\u00f3gica que no espera un valor negativo, lo que genera excepciones inesperadas. La excepci\\u00f3n inesperada no se maneja adecuadamente, lo que crea un bucle de ocupaci\\u00f3n al intentar (y fallar) sacar el paquete defectuoso del anillo xenstore.\"}]",
"id": "CVE-2022-42324",
"lastModified": "2024-11-21T07:24:45.167",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
"published": "2022-11-01T13:15:12.017",
"references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2022/11/01/10\", \"source\": \"security@xen.org\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-420.html\", \"source\": \"security@xen.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/\", \"source\": \"security@xen.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/\", \"source\": \"security@xen.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/\", \"source\": \"security@xen.org\"}, {\"url\": \"https://security.gentoo.org/glsa/202402-07\", \"source\": \"security@xen.org\"}, {\"url\": \"https://www.debian.org/security/2022/dsa-5272\", \"source\": \"security@xen.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://xenbits.xenproject.org/xsa/advisory-420.txt\", \"source\": \"security@xen.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2022/11/01/10\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Patch\", \"Third Party Advisory\"]}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-420.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/202402-07\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2022/dsa-5272\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://xenbits.xenproject.org/xsa/advisory-420.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "security@xen.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-681\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-42324\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2022-11-01T13:15:12.017\",\"lastModified\":\"2024-11-21T07:24:45.167\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.\"},{\"lang\":\"es\",\"value\":\"Problemas de truncado de enteros de 32 a 31 bits almacenados en Oxenstored. Los enteros en Ocaml tienen 63 o 31 bits de precisi\u00f3n confirmada. La librer\u00eda Ocaml Xenbus extrae una variable uint32_t de C del anillo y lo convierte directamente en un entero Ocaml. En compilaciones de Ocaml de 64 bits, esto est\u00e1 bien, pero en compilaciones de 32 bits, trunca el bit m\u00e1s significativo y luego crea confusi\u00f3n sin confirmaci\u00f3n/confirmada en el resto. Esto, a su vez, puede introducir un valor negativo en la l\u00f3gica que no espera un valor negativo, lo que genera excepciones inesperadas. La excepci\u00f3n inesperada no se maneja adecuadamente, lo que crea un bucle de ocupaci\u00f3n al intentar (y fallar) sacar el paquete defectuoso del anillo xenstore.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-681\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E516C0-98A4-4ADE-B69F-66A772E2BAAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2022/11/01/10\",\"source\":\"security@xen.org\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://xenbits.xen.org/xsa/advisory-420.html\",\"source\":\"security@xen.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/\",\"source\":\"security@xen.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/\",\"source\":\"security@xen.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/\",\"source\":\"security@xen.org\"},{\"url\":\"https://security.gentoo.org/glsa/202402-07\",\"source\":\"security@xen.org\"},{\"url\":\"https://www.debian.org/security/2022/dsa-5272\",\"source\":\"security@xen.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-420.txt\",\"source\":\"security@xen.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2022/11/01/10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://xenbits.xen.org/xsa/advisory-420.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202402-07\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2022/dsa-5272\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-420.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
CERTFR-2022-AVI-974
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Xen. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
None| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Xen toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Xen",
"vendor": {
"name": "XEN",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-42318",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42318"
},
{
"name": "CVE-2022-42321",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42321"
},
{
"name": "CVE-2022-42325",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42325"
},
{
"name": "CVE-2022-42326",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42326"
},
{
"name": "CVE-2022-42327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42327"
},
{
"name": "CVE-2022-42316",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42316"
},
{
"name": "CVE-2022-42324",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42324"
},
{
"name": "CVE-2022-42313",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42313"
},
{
"name": "CVE-2022-42317",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42317"
},
{
"name": "CVE-2022-42310",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42310"
},
{
"name": "CVE-2022-42314",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42314"
},
{
"name": "CVE-2022-42323",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42323"
},
{
"name": "CVE-2022-42312",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42312"
},
{
"name": "CVE-2022-42322",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42322"
},
{
"name": "CVE-2022-42319",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42319"
},
{
"name": "CVE-2022-42309",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42309"
},
{
"name": "CVE-2022-42311",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42311"
},
{
"name": "CVE-2022-42315",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42315"
},
{
"name": "CVE-2022-42320",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42320"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-974",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-11-02T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Xen. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service,\nun contournement de la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Xen",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 414 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-414.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 415 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-415.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 420 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-420.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 419 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-419.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 416 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-416.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 421 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-421.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 326 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-326.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 418 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-418.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 412 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-412.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 417 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-417.html"
}
]
}
CERTFR-2022-AVI-974
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Xen. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
None| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Xen toutes versions sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Xen",
"vendor": {
"name": "XEN",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-42318",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42318"
},
{
"name": "CVE-2022-42321",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42321"
},
{
"name": "CVE-2022-42325",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42325"
},
{
"name": "CVE-2022-42326",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42326"
},
{
"name": "CVE-2022-42327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42327"
},
{
"name": "CVE-2022-42316",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42316"
},
{
"name": "CVE-2022-42324",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42324"
},
{
"name": "CVE-2022-42313",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42313"
},
{
"name": "CVE-2022-42317",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42317"
},
{
"name": "CVE-2022-42310",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42310"
},
{
"name": "CVE-2022-42314",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42314"
},
{
"name": "CVE-2022-42323",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42323"
},
{
"name": "CVE-2022-42312",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42312"
},
{
"name": "CVE-2022-42322",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42322"
},
{
"name": "CVE-2022-42319",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42319"
},
{
"name": "CVE-2022-42309",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42309"
},
{
"name": "CVE-2022-42311",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42311"
},
{
"name": "CVE-2022-42315",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42315"
},
{
"name": "CVE-2022-42320",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-42320"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-974",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-11-02T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Xen. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service,\nun contournement de la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Xen",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 414 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-414.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 415 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-415.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 420 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-420.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 419 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-419.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 416 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-416.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 421 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-421.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 326 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-326.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 418 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-418.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 412 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-412.html"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Xen 417 du 01 novembre 2022",
"url": "https://xenbits.xen.org/xsa/advisory-417.html"
}
]
}
FKIE_CVE-2022-42324
Vulnerability from fkie_nvd - Published: 2022-11-01 13:15 - Updated: 2024-11-21 07:24| Vendor | Product | Version | |
|---|---|---|---|
| xen | xen | * | |
| debian | debian_linux | 11.0 | |
| fedoraproject | fedora | 35 | |
| fedoraproject | fedora | 36 | |
| fedoraproject | fedora | 37 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
"matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring."
},
{
"lang": "es",
"value": "Problemas de truncado de enteros de 32 a 31 bits almacenados en Oxenstored. Los enteros en Ocaml tienen 63 o 31 bits de precisi\u00f3n confirmada. La librer\u00eda Ocaml Xenbus extrae una variable uint32_t de C del anillo y lo convierte directamente en un entero Ocaml. En compilaciones de Ocaml de 64 bits, esto est\u00e1 bien, pero en compilaciones de 32 bits, trunca el bit m\u00e1s significativo y luego crea confusi\u00f3n sin confirmaci\u00f3n/confirmada en el resto. Esto, a su vez, puede introducir un valor negativo en la l\u00f3gica que no espera un valor negativo, lo que genera excepciones inesperadas. La excepci\u00f3n inesperada no se maneja adecuadamente, lo que crea un bucle de ocupaci\u00f3n al intentar (y fallar) sacar el paquete defectuoso del anillo xenstore."
}
],
"id": "CVE-2022-42324",
"lastModified": "2024-11-21T07:24:45.167",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-01T13:15:12.017",
"references": [
{
"source": "security@xen.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2022/11/01/10"
},
{
"source": "security@xen.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://xenbits.xen.org/xsa/advisory-420.html"
},
{
"source": "security@xen.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
},
{
"source": "security@xen.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"
},
{
"source": "security@xen.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"
},
{
"source": "security@xen.org",
"url": "https://security.gentoo.org/glsa/202402-07"
},
{
"source": "security@xen.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2022/dsa-5272"
},
{
"source": "security@xen.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://xenbits.xenproject.org/xsa/advisory-420.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2022/11/01/10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://xenbits.xen.org/xsa/advisory-420.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202402-07"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2022/dsa-5272"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://xenbits.xenproject.org/xsa/advisory-420.txt"
}
],
"sourceIdentifier": "security@xen.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-681"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-2HQJ-M7QJ-9PC3
Vulnerability from github – Published: 2022-11-01 19:00 – Updated: 2022-11-03 19:00Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.
{
"affected": [],
"aliases": [
"CVE-2022-42324"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-681"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-01T13:15:00Z",
"severity": "MODERATE"
},
"details": "Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.",
"id": "GHSA-2hqj-m7qj-9pc3",
"modified": "2022-11-03T19:00:25Z",
"published": "2022-11-01T19:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42324"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202402-07"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5272"
},
{
"type": "WEB",
"url": "https://xenbits.xenproject.org/xsa/advisory-420.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/11/01/10"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-420.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GSD-2022-42324
Vulnerability from gsd - Updated: 2023-12-13 01:19{
"GSD": {
"alias": "CVE-2022-42324",
"description": "Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.",
"id": "GSD-2022-42324",
"references": [
"https://www.debian.org/security/2022/dsa-5272",
"https://www.suse.com/security/cve/CVE-2022-42324.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-42324"
],
"details": "Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.",
"id": "GSD-2022-42324",
"modified": "2023-12-13T01:19:10.931973Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@xen.org",
"ID": "CVE-2022-42324",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "xen",
"version": {
"version_data": [
{
"version_affected": "?",
"version_value": "consult Xen advisory XSA-420"
}
]
}
}
]
},
"vendor_name": "Xen"
}
]
}
},
"configuration": {
"configuration_data": {
"description": {
"description_data": [
{
"lang": "eng",
"value": "All versions of Xen are affected.\n\nSystems running a 32-bit build of oxenstored are affected.\n\nSystems running a 64-bit build of oxenstored, or systems running (C)\nxenstored are not affected."
}
]
}
}
},
"credit": {
"credit_data": {
"description": {
"description_data": [
{
"lang": "eng",
"value": "This issue was discovered by J\u00fcrgen Gro\u00df of SUSE."
}
]
}
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring."
}
]
},
"impact": {
"impact_data": {
"description": {
"description_data": [
{
"lang": "eng",
"value": "A malicious or buggy guest can write a packet into the xenstore ring\nwhich causes 32-bit builds of oxenstored to busy loop."
}
]
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "unknown"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://xenbits.xenproject.org/xsa/advisory-420.txt",
"refsource": "MISC",
"url": "https://xenbits.xenproject.org/xsa/advisory-420.txt"
},
{
"name": "http://xenbits.xen.org/xsa/advisory-420.html",
"refsource": "CONFIRM",
"url": "http://xenbits.xen.org/xsa/advisory-420.html"
},
{
"name": "[oss-security] 20221101 Xen Security Advisory 420 v2 (CVE-2022-42324) - Oxenstored 32-\u003e31 bit integer truncation issues",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2022/11/01/10"
},
{
"name": "DSA-5272",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2022/dsa-5272"
},
{
"name": "FEDORA-2022-07438e12df",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"
},
{
"name": "FEDORA-2022-99af00f60e",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"
},
{
"name": "FEDORA-2022-9f51d13fa3",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
},
{
"name": "GLSA-202402-07",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202402-07"
}
]
},
"workaround": {
"workaround_data": {
"description": {
"description_data": [
{
"lang": "eng",
"value": "Running xenstored instead of oxenstored will avoid the vulnerability."
}
]
}
}
}
},
"nvd.nist.gov": {
"cve": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
"matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Oxenstored 32-\u003e31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring."
},
{
"lang": "es",
"value": "Problemas de truncado de enteros de 32 a 31 bits almacenados en Oxenstored. Los enteros en Ocaml tienen 63 o 31 bits de precisi\u00f3n confirmada. La librer\u00eda Ocaml Xenbus extrae una variable uint32_t de C del anillo y lo convierte directamente en un entero Ocaml. En compilaciones de Ocaml de 64 bits, esto est\u00e1 bien, pero en compilaciones de 32 bits, trunca el bit m\u00e1s significativo y luego crea confusi\u00f3n sin confirmaci\u00f3n/confirmada en el resto. Esto, a su vez, puede introducir un valor negativo en la l\u00f3gica que no espera un valor negativo, lo que genera excepciones inesperadas. La excepci\u00f3n inesperada no se maneja adecuadamente, lo que crea un bucle de ocupaci\u00f3n al intentar (y fallar) sacar el paquete defectuoso del anillo xenstore."
}
],
"id": "CVE-2022-42324",
"lastModified": "2024-02-04T08:15:12.647",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-01T13:15:12.017",
"references": [
{
"source": "security@xen.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2022/11/01/10"
},
{
"source": "security@xen.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://xenbits.xen.org/xsa/advisory-420.html"
},
{
"source": "security@xen.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/"
},
{
"source": "security@xen.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/"
},
{
"source": "security@xen.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/"
},
{
"source": "security@xen.org",
"url": "https://security.gentoo.org/glsa/202402-07"
},
{
"source": "security@xen.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2022/dsa-5272"
},
{
"source": "security@xen.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://xenbits.xenproject.org/xsa/advisory-420.txt"
}
],
"sourceIdentifier": "security@xen.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-681"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
}
}
}
WID-SEC-W-2022-1939
Vulnerability from csaf_certbund - Published: 2022-11-01 23:00 - Updated: 2024-02-04 23:00In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Xen 4.15.x
Open Source / Xen
|
cpe:/o:xen:xen:4.15.x
|
— | |
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Open Source Xen 4.16.x
Open Source / Xen
|
cpe:/o:xen:xen:4.16.x
|
— | |
|
Open Source Xen 4.13.x
Open Source / Xen
|
cpe:/o:xen:xen:4.13.x
|
— | |
|
Gentoo Linux
Gentoo
|
cpe:/o:gentoo:linux:-
|
— | |
|
Citrix Systems Hypervisor 8.2 LTSR CU1
Citrix Systems
|
cpe:/o:citrix:hypervisor:8.2_ltsr_cu1
|
— |
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Xen ist ein Virtueller-Maschinen-Monitor (VMM), der Hardware (x86, IA-64, PowerPC) f\u00fcr die darauf laufenden Systeme (Domains) paravirtualisiert.\r\nCitrix Hypervisor ist eine Plattform f\u00fcr Desktop-, Server- und Cloud-Virtualisierungsinfrastrukturen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xen und Citrix Systems Hypervisor ausnutzen um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern.",
"title": "Angriff"
},
{
"category": "general",
"text": "- UNIX\n- Linux\n- Windows\n- Sonstiges",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2022-1939 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1939.json"
},
{
"category": "self",
"summary": "WID-SEC-2022-1939 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1939"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-412.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-413.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-414.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-415.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-416.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-417.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-418.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-419.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-420.html"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-421.html"
},
{
"category": "external",
"summary": "Citrix Hypervisor Security Bulletin",
"url": "https://support.citrix.com/article/CTX472851/citrix-hypervisor-security-bulletin-for-cve202242316-cve202242317-cve202242318"
},
{
"category": "external",
"summary": "Xen Security Advisory vom 2022-11-01",
"url": "https://xenbits.xen.org/xsa/advisory-326.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-5272 vom 2022-11-06",
"url": "https://lists.debian.org/debian-security-announce/2022/msg00242.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:3925-1 vom 2022-11-09",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012859.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:3928-1 vom 2022-11-10",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012866.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:3947-1 vom 2022-11-11",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012906.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:3960-1 vom 2022-11-11",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012903.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:3971-1 vom 2022-11-14",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012910.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:4007-1 vom 2022-11-16",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012939.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:4051-1 vom 2022-11-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012964.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:4241-1 vom 2022-11-28",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013122.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2022:4332-1 vom 2022-12-06",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2022-December/013191.html"
},
{
"category": "external",
"summary": "ORACLE OVMSA-2023-0005 vom 2023-03-22",
"url": "https://oss.oracle.com/pipermail/oraclevm-errata/2023-March/001071.html"
},
{
"category": "external",
"summary": "Gentoo Linux Security Advisory GLSA-202402-07 vom 2024-02-04",
"url": "https://security.gentoo.org/glsa/202402-07"
}
],
"source_lang": "en-US",
"title": "Xen: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-02-04T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:37:27.697+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2022-1939",
"initial_release_date": "2022-11-01T23:00:00.000+00:00",
"revision_history": [
{
"date": "2022-11-01T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2022-11-02T23:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: FEDORA-2022-1859E9912E, FEDORA-2022-07438E12DF, FEDORA-2022-674B1243C2"
},
{
"date": "2022-11-06T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2022-11-08T23:00:00.000+00:00",
"number": "4",
"summary": "Referenz(en) aufgenommen: FEDORA-2022-9F51D13FA3"
},
{
"date": "2022-11-09T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-11-10T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-11-13T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-11-14T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-11-16T23:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-11-17T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-11-28T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2022-12-06T23:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2023-03-22T23:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von ORACLE aufgenommen"
},
{
"date": "2024-02-04T23:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von Gentoo aufgenommen"
}
],
"status": "final",
"version": "14"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Citrix Systems Hypervisor 8.2 LTSR CU1",
"product": {
"name": "Citrix Systems Hypervisor 8.2 LTSR CU1",
"product_id": "T024873",
"product_identification_helper": {
"cpe": "cpe:/o:citrix:hypervisor:8.2_ltsr_cu1"
}
}
}
],
"category": "vendor",
"name": "Citrix Systems"
},
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Gentoo Linux",
"product": {
"name": "Gentoo Linux",
"product_id": "T012167",
"product_identification_helper": {
"cpe": "cpe:/o:gentoo:linux:-"
}
}
}
],
"category": "vendor",
"name": "Gentoo"
},
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Open Source Xen \u003e 4.9",
"product": {
"name": "Open Source Xen \u003e 4.9",
"product_id": "T014374",
"product_identification_helper": {
"cpe": "cpe:/o:xen:xen:4.9"
}
}
},
{
"category": "product_name",
"name": "Open Source Xen 4.13.x",
"product": {
"name": "Open Source Xen 4.13.x",
"product_id": "T016868",
"product_identification_helper": {
"cpe": "cpe:/o:xen:xen:4.13.x"
}
}
},
{
"category": "product_name",
"name": "Open Source Xen 4.15.x",
"product": {
"name": "Open Source Xen 4.15.x",
"product_id": "T020268",
"product_identification_helper": {
"cpe": "cpe:/o:xen:xen:4.15.x"
}
}
},
{
"category": "product_name",
"name": "Open Source Xen 4.16.x",
"product": {
"name": "Open Source Xen 4.16.x",
"product_id": "T023456",
"product_identification_helper": {
"cpe": "cpe:/o:xen:xen:4.16.x"
}
}
}
],
"category": "product_name",
"name": "Xen"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-33749",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-33749"
},
{
"cve": "CVE-2022-42309",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42309"
},
{
"cve": "CVE-2022-42310",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42310"
},
{
"cve": "CVE-2022-42311",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42311"
},
{
"cve": "CVE-2022-42312",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42312"
},
{
"cve": "CVE-2022-42313",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42313"
},
{
"cve": "CVE-2022-42314",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42314"
},
{
"cve": "CVE-2022-42315",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42315"
},
{
"cve": "CVE-2022-42316",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42316"
},
{
"cve": "CVE-2022-42317",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42317"
},
{
"cve": "CVE-2022-42318",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42318"
},
{
"cve": "CVE-2022-42319",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42319"
},
{
"cve": "CVE-2022-42320",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42320"
},
{
"cve": "CVE-2022-42321",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42321"
},
{
"cve": "CVE-2022-42322",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42322"
},
{
"cve": "CVE-2022-42323",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42323"
},
{
"cve": "CVE-2022-42324",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42324"
},
{
"cve": "CVE-2022-42325",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42325"
},
{
"cve": "CVE-2022-42326",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42326"
},
{
"cve": "CVE-2022-42327",
"notes": [
{
"category": "description",
"text": "In Xen und Citrix Systems Hypervisor existieren mehrere Schwachstellen. Ein Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern. Zur Ausnutzung einiger Schwachstellen ist eine Anmeldung mit erweiterten Rechten erforderlich."
}
],
"product_status": {
"known_affected": [
"T020268",
"2951",
"T002207",
"T023456",
"T016868",
"T012167",
"T024873"
]
},
"release_date": "2022-11-01T23:00:00.000+00:00",
"title": "CVE-2022-42327"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.