CVE-2022-42316

Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction

• CWE-770
• CWE-770

• http://xenbits.xen.org/xsa/advisory-326.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
• https://www.debian.org/security/2022/dsa-5272Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-326.txtPatch, Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-326.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
• https://www.debian.org/security/2022/dsa-5272Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-326.txtPatch, Vendor Advisory

Published

Nov 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42310Xenstore: Guests can create orphaned Xenstore nodes By creat…5.5
• CVE-2022-42311Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42312Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42313Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42314Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42315Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42317Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42318Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42319Xenstore: Guests can cause Xenstore to not free temporary me…6.5
• CVE-2022-4232A vulnerability, which was classified as critical, was found…9.8
• CVE-2022-42320Xenstore: Guests can get access to Xenstore nodes of deleted…7
• CVE-2022-42321Xenstore: Guests can crash xenstored via exhausting the stac…6.5