|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2022-42309: xen: Xenstore: Guests can crash xenstored (XSA-414) | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Carlos López <carlos.lopez> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | NEW --- | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | carnold, jgross, rfrohl |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/345733/ | ||
| Whiteboard: | CVSSv3.1:SUSE:CVE-2022-42309:7.5:(AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: | Attached patches | ||
SUSE-SU-2022:3925-1: An update that fixes 20 vulnerabilities is now available. Category: security (important) Bug References: 1185104,1193923,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496 CVE References: CVE-2021-28689,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): xen-4.10.4_40-150000.3.84.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): xen-4.10.4_40-150000.3.84.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): xen-4.10.4_40-150000.3.84.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:3928-1: An update that fixes 24 vulnerabilities is now available. Category: security (important) Bug References: 1185104,1193923,1199966,1200762,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496 CVE References: CVE-2021-28689,CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): xen-4.12.4_30-150100.3.80.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): xen-4.12.4_30-150100.3.80.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): xen-4.12.4_30-150100.3.80.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): xen-4.12.4_30-150100.3.80.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): xen-4.12.4_30-150100.3.80.1 SUSE Enterprise Storage 6 (src): xen-4.12.4_30-150100.3.80.1 SUSE CaaS Platform 4.0 (src): xen-4.12.4_30-150100.3.80.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:3960-1: An update that fixes 17 vulnerabilities is now available. Category: security (important) Bug References: 1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496 CVE References: CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP3-BCL (src): xen-4.9.4_34-3.114.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:3947-1: An update that fixes 20 vulnerabilities is now available. Category: security (important) Bug References: 1027519,1193923,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496 CVE References: CVE-2022-33746,CVE-2022-33747,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326 JIRA References: Sources used: openSUSE Leap Micro 5.2 (src): xen-4.14.5_08-150300.3.40.1 openSUSE Leap 15.3 (src): xen-4.14.5_08-150300.3.40.1 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): xen-4.14.5_08-150300.3.40.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): xen-4.14.5_08-150300.3.40.1 SUSE Linux Enterprise Micro 5.2 (src): xen-4.14.5_08-150300.3.40.1 SUSE Linux Enterprise Micro 5.1 (src): xen-4.14.5_08-150300.3.40.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:3971-1: An update that fixes 20 vulnerabilities is now available. Category: security (important) Bug References: 1027519,1167608,1185104,1193923,1199966,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496 CVE References: CVE-2021-28689,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326 JIRA References: Sources used: SUSE Manager Server 4.1 (src): xen-4.13.4_16-150200.3.65.1 SUSE Manager Retail Branch Server 4.1 (src): xen-4.13.4_16-150200.3.65.1 SUSE Manager Proxy 4.1 (src): xen-4.13.4_16-150200.3.65.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): xen-4.13.4_16-150200.3.65.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): xen-4.13.4_16-150200.3.65.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): xen-4.13.4_16-150200.3.65.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): xen-4.13.4_16-150200.3.65.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): xen-4.13.4_16-150200.3.65.1 SUSE Enterprise Storage 7 (src): xen-4.13.4_16-150200.3.65.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:4007-1: An update that fixes 21 vulnerabilities is now available. Category: security (important) Bug References: 1027519,1193923,1203806,1203807,1204482,1204483,1204485,1204487,1204488,1204489,1204490,1204494,1204496 CVE References: CVE-2022-33746,CVE-2022-33747,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326,CVE-2022-42327 JIRA References: Sources used: openSUSE Leap 15.4 (src): xen-4.16.2_08-150400.4.16.1 SUSE Linux Enterprise Module for Server Applications 15-SP4 (src): xen-4.16.2_08-150400.4.16.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): xen-4.16.2_08-150400.4.16.1 SUSE Linux Enterprise Micro 5.3 (src): xen-4.16.2_08-150400.4.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:4051-1: An update that fixes 17 vulnerabilities is now available. Category: security (important) Bug References: 1185104,1203806,1203807,1204482,1204485,1204487,1204489,1204490,1204494 CVE References: CVE-2021-28689,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP2-BCL (src): xen-4.7.6_28-43.98.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:4241-1: An update that fixes 20 vulnerabilities is now available. Category: security (important) Bug References: 1185104,1193923,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496 CVE References: CVE-2021-28689,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): xen-4.11.4_34-2.83.1 SUSE OpenStack Cloud 9 (src): xen-4.11.4_34-2.83.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): xen-4.11.4_34-2.83.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): xen-4.11.4_34-2.83.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:4332-1: An update that fixes 17 vulnerabilities is now available. Category: security (important) Bug References: 1193923,1203806,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496 CVE References: CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): xen-4.12.4_30-3.82.1 SUSE Linux Enterprise Server 12-SP5 (src): xen-4.12.4_30-3.82.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. |
Xen Security Advisory CVE-2022-42309 / XSA-414 version 2 Xenstore: Guests can crash xenstored UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain. IMPACT ====== A malicious guest can cause xenstored to crash, resulting in the inability to create new guests or to change the configuration of running guests. Memory corruption in xenstored or privilege escalation of a guest can't be ruled out. VULNERABLE SYSTEMS ================== All Xen versions with the fix for XSA-115 running the C variant of Xenstore (xenstored or xenstore-stubdom) are vulnerable. Systems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable. MITIGATION ========== Using oxenstored instead of xenstored will avoid the vulnerability. CREDITS ======= This issue was discovered by Julien Grall of Amazon. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa414.patch xen-unstable, Xen 4.16.x - 4.15.x xsa414-4.14.patch Xen 4.14.x - 4.13.x $ sha256sum xsa414* aad9be1af22eec504bf45ff651509be9106e7d4ceb7552befcf3152a17e5efbe xsa414.meta f0683bce3b27dd516367091e845559359c12a193b4e051867b580ea46d58359f xsa414.patch 6eb053052786c738abaf747ea69384fd47525186fa6b6ea247383c7cbfbf3e07 xsa414-4.14.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html