CVE-2022-42309

Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain.

• CWE-763

• https://www.openwall.com/lists/oss-security/2022/11/01/4Mailing List, Third Party Advisory
• https://xenbits.xen.org/xsa/advisory-414.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
• https://security.gentoo.org/glsa/202402-07
• https://www.debian.org/security/2022/dsa-5272Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-414.txtPatch, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2022/11/01/4Mailing List, Third Party Advisory
• https://xenbits.xen.org/xsa/advisory-414.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
• https://security.gentoo.org/glsa/202402-07
• https://www.debian.org/security/2022/dsa-5272Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-414.txtPatch, Vendor Advisory

Published

Nov 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42303An issue was discovered in Veritas NetBackup through 10.0 an…9.8
• CVE-2022-42304An issue was discovered in Veritas NetBackup through 10.0 an…9.8
• CVE-2022-42305An issue was discovered in Veritas NetBackup through 10.0.0.…7.5
• CVE-2022-42306An issue was discovered in Veritas NetBackup through 8.2 and…5.5
• CVE-2022-42307An issue was discovered in Veritas NetBackup through 10.0.0.…9.8
• CVE-2022-42308An issue was discovered in Veritas NetBackup through 8.2 and…7.1
• CVE-2022-4231A vulnerability, which was classified as problematic, has be…5.4
• CVE-2022-42310Xenstore: Guests can create orphaned Xenstore nodes By creat…5.5
• CVE-2022-42311Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42312Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42313Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42314Xenstore: guests can let run xenstored out of memory T[his C…6.5