DeutschShown in its original language — a full translation is planned for a future version.
Xen: Mehrere Schwachstellen
view advisory published 2022-11-01
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xen und Citrix Systems Hypervisor ausnutzen um einen Denial of Service zu verursachen, Informationen offenzulegen oder seine Rechte zu erweitern.
01
describes (20)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-42327US | high7.1 | — | ||
x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by movin… | ||||
| CVE-2022-42326US | medium5.5 | — | ||
Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corres… | ||||
| CVE-2022-42325US | medium5.5 | — | ||
Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corres… | ||||
| CVE-2022-42324US | medium5.5 | — | ||
Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it di… | ||||
| CVE-2022-42323US | medium5.5 | — | ||
Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… | ||||
| CVE-2022-42322US | medium5.5 | — | ||
Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… | ||||
| CVE-2022-42321US | medium6.5 | — | ||
Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With suffi… | ||||
| CVE-2022-42320US | high7.0 | — | ||
Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenstore nodes left with a… | ||||
| CVE-2022-42319US | medium6.5 | — | ||
Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily. T… | ||||
| CVE-2022-42318US | medium6.5 | — | ||
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.… | ||||
| CVE-2022-42317US | medium6.5 | — | ||
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.… | ||||
| CVE-2022-42316US | medium6.5 | — | ||
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.… | ||||
| CVE-2022-42315US | medium6.5 | — | ||
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.… | ||||
| CVE-2022-42314US | medium6.5 | — | ||
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.… | ||||
| CVE-2022-42313US | medium6.5 | — | ||
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.… | ||||
| CVE-2022-42312US | medium6.5 | — | ||
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.… | ||||
| CVE-2022-42311US | medium6.5 | — | ||
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.… | ||||
| CVE-2022-42310US | medium5.5 | — | ||
Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xensto… | ||||
| CVE-2022-42309US | high8.8 | — | ||
Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resultin… | ||||
| CVE-2022-33749US | medium5.3 | — | ||
XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be unable to accept new req… | ||||
02
references
External citations — patches, advisories, analysis.
- Debian Security Advisory DSA-5272 vom 2022-11-06external
- SUSE Security Update SUSE-SU-2022:4332-1 vom 2022-12-06external
- SUSE Security Update SUSE-SU-2022:3925-1 vom 2022-11-09external
- SUSE Security Update SUSE-SU-2022:3928-1 vom 2022-11-10external
- SUSE Security Update SUSE-SU-2022:3960-1 vom 2022-11-11external
- SUSE Security Update SUSE-SU-2022:3947-1 vom 2022-11-11external
- SUSE Security Update SUSE-SU-2022:3971-1 vom 2022-11-14external
- SUSE Security Update SUSE-SU-2022:4007-1 vom 2022-11-16external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan