Bug 1204489 – VUL-0: CVE-2022-42320: xen: Xenstore: Guests can get access to Xenstore nodes of deleted domains (XSA-417)

Bug 1204489 - (CVE-2022-42320) VUL-0: CVE-2022-42320: xen: Xenstore: Guests can get access to Xenstore nodes of deleted domains (XSA-417)

(CVE-2022-42320)
Summary:	VUL-0: CVE-2022-42320: xen: Xenstore: Guests can get access to Xenstore nodes...

Status:	NEW

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/345739/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-42320:7.5:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2022-10-19 09:54 UTC by Carlos López
Modified:	2022-12-06 17:22 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Attached patch (2.34 KB, application/zip) 2022-10-19 09:55 UTC, Carlos López	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Comment 7 Robert Frohl 2022-11-01 14:03:08 UTC

            Xen Security Advisory CVE-2022-42320 / XSA-417
                               version 2

 Xenstore: Guests can get access to Xenstore nodes of deleted domains

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

Access rights of Xenstore nodes are per domid.  When a domain is gone,
there might be Xenstore nodes left with access rights containing the
domid of the removed domain.  This is normally no problem, as those
access right entries will be corrected when such a node is written
later.

There is a small time window when a new domain is created, where the
access rights of a past domain with the same domid as the new one will
be regarded to be still valid, leading to the new domain being able to
get access to a node which was meant to be accessible by the removed
domain.  For this to happen another domain needs to write the node
before the newly created domain is being introduced to Xenstore by
dom0.

IMPACT
======

In some circumstances, it might be possible for a new guest domain to
access resources belonging to a previous domain.  The impact would
depend on the software in use and the configuration, but might include
any of denial of service, information leak, or privilege escalation.

VULNERABLE SYSTEMS
==================

All versions of Xen are in principle vulnerable.

Only systems running the C variant of Xenstore (xenstored or xenstore-
stubdom) are vulnerable.

Systems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable.

Vulnerable systems are only those running software where one domain is
granted access to another's xenstore nodes, without complete cleanup
of those nodes on domain destruction.  No such software is enabled in
default configurations of upstream Xen.

Therefore upstream Xen, without additional management software (in
host or guest(s)), is not vulnerable in the default (host and guest)
configuration.

MITIGATION
==========

Running oxenstored instead of xenstored will avoid the vulnerability.

CREDITS
=======

This issue was discovered by Jürgen Groß of SUSE.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa417.patch           xen-unstable, Xen 4.16.x - 4.13.x

$ sha256sum xsa417*
62b37c77cc97374685d1df31da57809ddd6c9ad2272fb3380555e81dc85f0cd8  xsa417.meta
b0c3bdc1723ead350c86b5a42f5e28445fa331ba5f463d82385fdaeb80119b30  xsa417.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.


(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html

Comment 8 Swamp Workflow Management 2022-11-09 17:28:39 UTC

SUSE-SU-2022:3925-1: An update that fixes 20 vulnerabilities is now available.

Category: security (important)
Bug References: 1185104,1193923,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496
CVE References: CVE-2021-28689,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    xen-4.10.4_40-150000.3.84.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    xen-4.10.4_40-150000.3.84.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    xen-4.10.4_40-150000.3.84.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 9 Swamp Workflow Management 2022-11-10 14:23:57 UTC

SUSE-SU-2022:3928-1: An update that fixes 24 vulnerabilities is now available.

Category: security (important)
Bug References: 1185104,1193923,1199966,1200762,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496
CVE References: CVE-2021-28689,CVE-2022-26365,CVE-2022-33740,CVE-2022-33741,CVE-2022-33742,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    xen-4.12.4_30-150100.3.80.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    xen-4.12.4_30-150100.3.80.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    xen-4.12.4_30-150100.3.80.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    xen-4.12.4_30-150100.3.80.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    xen-4.12.4_30-150100.3.80.1
SUSE Enterprise Storage 6 (src):    xen-4.12.4_30-150100.3.80.1
SUSE CaaS Platform 4.0 (src):    xen-4.12.4_30-150100.3.80.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Swamp Workflow Management 2022-11-11 20:53:12 UTC

SUSE-SU-2022:3960-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496
CVE References: CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP3-BCL (src):    xen-4.9.4_34-3.114.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2022-11-11 21:00:57 UTC

SUSE-SU-2022:3947-1: An update that fixes 20 vulnerabilities is now available.

Category: security (important)
Bug References: 1027519,1193923,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496
CVE References: CVE-2022-33746,CVE-2022-33747,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326
JIRA References: 
Sources used:
openSUSE Leap Micro 5.2 (src):    xen-4.14.5_08-150300.3.40.1
openSUSE Leap 15.3 (src):    xen-4.14.5_08-150300.3.40.1
SUSE Linux Enterprise Module for Server Applications 15-SP3 (src):    xen-4.14.5_08-150300.3.40.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    xen-4.14.5_08-150300.3.40.1
SUSE Linux Enterprise Micro 5.2 (src):    xen-4.14.5_08-150300.3.40.1
SUSE Linux Enterprise Micro 5.1 (src):    xen-4.14.5_08-150300.3.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Swamp Workflow Management 2022-11-14 17:22:14 UTC

SUSE-SU-2022:3971-1: An update that fixes 20 vulnerabilities is now available.

Category: security (important)
Bug References: 1027519,1167608,1185104,1193923,1199966,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496
CVE References: CVE-2021-28689,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    xen-4.13.4_16-150200.3.65.1
SUSE Manager Retail Branch Server 4.1 (src):    xen-4.13.4_16-150200.3.65.1
SUSE Manager Proxy 4.1 (src):    xen-4.13.4_16-150200.3.65.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    xen-4.13.4_16-150200.3.65.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    xen-4.13.4_16-150200.3.65.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    xen-4.13.4_16-150200.3.65.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    xen-4.13.4_16-150200.3.65.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    xen-4.13.4_16-150200.3.65.1
SUSE Enterprise Storage 7 (src):    xen-4.13.4_16-150200.3.65.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Swamp Workflow Management 2022-11-16 11:23:08 UTC

SUSE-SU-2022:4007-1: An update that fixes 21 vulnerabilities is now available.

Category: security (important)
Bug References: 1027519,1193923,1203806,1203807,1204482,1204483,1204485,1204487,1204488,1204489,1204490,1204494,1204496
CVE References: CVE-2022-33746,CVE-2022-33747,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326,CVE-2022-42327
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    xen-4.16.2_08-150400.4.16.1
SUSE Linux Enterprise Module for Server Applications 15-SP4 (src):    xen-4.16.2_08-150400.4.16.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    xen-4.16.2_08-150400.4.16.1
SUSE Linux Enterprise Micro 5.3 (src):    xen-4.16.2_08-150400.4.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 14 Swamp Workflow Management 2022-11-17 17:25:51 UTC

SUSE-SU-2022:4051-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 1185104,1203806,1203807,1204482,1204485,1204487,1204489,1204490,1204494
CVE References: CVE-2021-28689,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP2-BCL (src):    xen-4.7.6_28-43.98.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Swamp Workflow Management 2022-11-28 14:25:24 UTC

SUSE-SU-2022:4241-1: An update that fixes 20 vulnerabilities is now available.

Category: security (important)
Bug References: 1185104,1193923,1203806,1203807,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496
CVE References: CVE-2021-28689,CVE-2022-33746,CVE-2022-33748,CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    xen-4.11.4_34-2.83.1
SUSE OpenStack Cloud 9 (src):    xen-4.11.4_34-2.83.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    xen-4.11.4_34-2.83.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    xen-4.11.4_34-2.83.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 16 Swamp Workflow Management 2022-12-06 17:22:59 UTC

SUSE-SU-2022:4332-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 1193923,1203806,1204482,1204485,1204487,1204488,1204489,1204490,1204494,1204496
CVE References: CVE-2022-42309,CVE-2022-42310,CVE-2022-42311,CVE-2022-42312,CVE-2022-42313,CVE-2022-42314,CVE-2022-42315,CVE-2022-42316,CVE-2022-42317,CVE-2022-42318,CVE-2022-42319,CVE-2022-42320,CVE-2022-42321,CVE-2022-42322,CVE-2022-42323,CVE-2022-42325,CVE-2022-42326
JIRA References: 
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    xen-4.12.4_30-3.82.1
SUSE Linux Enterprise Server 12-SP5 (src):    xen-4.12.4_30-3.82.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.