CVE-2022-42319

Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only after the request has been finished completely. A request is regarded to be finished only after the guest has read the response message of the request from the ring page. Thus a guest not reading the response can cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of Service (DoS) of xenstored.

• CWE-401

• https://www.openwall.com/lists/oss-security/2022/11/01/6Mailing List, Third Party Advisory
• https://xenbits.xen.org/xsa/advisory-416.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
• https://security.gentoo.org/glsa/202402-07
• https://www.debian.org/security/2022/dsa-5272Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-416.txtPatch, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2022/11/01/6Mailing List, Third Party Advisory
• https://xenbits.xen.org/xsa/advisory-416.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZVXG7OOOXCX6VIPEMLFDPIPUTFAYWPE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
• https://security.gentoo.org/glsa/202402-07
• https://www.debian.org/security/2022/dsa-5272Third Party Advisory
• https://xenbits.xenproject.org/xsa/advisory-416.txtPatch, Vendor Advisory

Published

Nov 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42313Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42314Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42315Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42316Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42317Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-42318Xenstore: guests can let run xenstored out of memory T[his C…6.5
• CVE-2022-4232A vulnerability, which was classified as critical, was found…9.8
• CVE-2022-42320Xenstore: Guests can get access to Xenstore nodes of deleted…7
• CVE-2022-42321Xenstore: Guests can crash xenstored via exhausting the stac…6.5
• CVE-2022-42322Xenstore: Cooperating guests can create arbitrary numbers of…5.5
• CVE-2022-42323Xenstore: Cooperating guests can create arbitrary numbers of…5.5
• CVE-2022-42324Oxenstored 32->31 bit integer truncation issues Integers in …5.5