CVE-2022-42319

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2022-42319 / XSA-416 version 2 Xenstore: Guests can cause Xenstore to not free temporary memory UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only after the request has been finished completely. A request is regarded to be finished only after the guest has read the response message of the request from the ring page. Thus a guest not reading the response can cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of Service (DoS) of xenstored. IMPACT ====== A malicious guest can cause DoS of xenstored, resulting in the inability to create new guests or to change the configuration of already running guests. VULNERABLE SYSTEMS ================== Xen systems with version 4.9 and newer running the C variant of Xenstore (xenstored or xenstore-stubdom) are vulnerable. Systems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable. MITIGATION ========== Using oxenstored instead of xenstored will avoid the vulnerability. CREDITS ======= This issue was discovered by Julien Grall of Amazon. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa416.patch xen-unstable xsa416-4.16.patch Xen 4.16.x xsa416-4.15.patch Xen 4.15.x xsa416-4.14.patch Xen 4.14.x xsa416-4.13.patch Xen 4.13.x $ sha256sum xsa416* 9f5f459b0c5b71ba25503d176c59732baf2ed174688b59e51010f22f8eecd218 xsa416.meta 6a28884392997baaea046ac8f1df86ffaec64febdabf17a8753e451ef3cab0f7 xsa416.patch 5838de576be5a71be46ab2e58287ea7d9c774f68f588c7d1f472a190b5923446 xsa416-4.13.patch cb06c57ff0158899e61b26901e06d931838f68958d610fbeff1c76edb9c8b4e1 xsa416-4.14.patch 68b7128b0f1e1d6de345dbc47dfdd583beff840c96e625fcf6e6a82679ff3732 xsa416-4.15.patch c4bb88546b272925d85d75d62f552d91698a10faaac1a0ce6cac3c54eeeda6a2 xsa416-4.16.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team’s decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community’s agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmNg+6UMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZx0IH/0A0O9/AnlHpVEM8RUVrHqDLbVozGVbroH/OsA05 Fgj5kCqgRQs03H2uMnIboDL9RbgnjqRkU1cVf0gG2MWRzvMofxjLykUN8fUxcax0 6qCnAPF1m5kFA/LE6iyjWem6949n7B/LZb2NCJ9EFwb+W1/g6/skTj82ngvlSO+6 svxuK+BnTUshcDI6b3MSos4CPVpF4VMYB8JogUo9XANUdu7mblV4jMPn/wt712MA tEOcxeIPvzkYpPTzV5bEQGKmRy4WpnpSKDPDL8+PVFMFdyMartx98RoZFnldTmlN fifLfsTq3h3NxTA7V0KUXdO5tb0ZPLQiN/8fn7AwO/2HtdY= =YXaE -----END PGP SIGNATURE-----