CVE-2022-42325

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2022-42325,CVE-2022-42326 / XSA-421 version 2 Xenstore: Guests can create arbitrary number of nodes via transactions UPDATES IN VERSION 2 ==================== Fix typo in title. Public release. ISSUE DESCRIPTION ================= In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes. IMPACT ====== A malicious guest can cause memory shortage in xenstored, resulting in a Denial of Service (DoS) of xenstored. This will inhibit creating new guests and changing the configuration of already running guests. VULNERABLE SYSTEMS ================== All systems running Xen version 4.9 and newer are affected. Only systems running the C variant of Xenstore (xenstored or xenstore- stubdom) are vulnerable. Systems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable. MITIGATION ========== Running oxenstored instead of xenstored will avoid the vulnerability. CREDITS ======= This issue was discovered by Julien Grall of Amazon. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa421/xsa421-??.patch xen-unstable, Xen 4.16.x xsa421/xsa421-4.15-??.patch Xen 4.15.x - 4.13.x $ sha256sum xsa421* xsa421*/* c2184bfb9f84220c648531e1ba13a1db0533019c999622e605a6000393e97e65 xsa421.meta eb2c5ef828e75c79a5f2eb3274a191d3b5d13107db792b8ba2b664ef335a738e xsa421/xsa421-01.patch 50532ad32975fdaa2674e454da125d5d44d5b471f3cf7c91f24d4128e2e4d090 xsa421/xsa421-02.patch 7ea5a47c293fd2379ec99ef88e29d4a19f03221aa731a600da510f61ff702be9 xsa421/xsa421-4.15-01.patch 8198a41789ed2c63f79f64ea491d9ebbf6d31b78a47e0ff0bbf3db8257fc5f39 xsa421/xsa421-4.15-02.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team’s decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community’s agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmNg+7IMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZgUUH/19VNMAsM8ROQ/MWuba28+8Y7iwwi/+fg5byAefj vsQp+VfTODpvfQDngfqt43LhzHZ2YnUJqvsvteDiQKRrLtqakR5xrfAN5pNnzv8Q PJQfIlsaxyVbeUWdsc2BPuQIdPi9hGGxVjpxTfLNSpbIk0E7pXzeztQKW7buxERv vFLh358t2FBXXwpMD9qFHcTZX+tz9nVg9/0/POoiBb/7LKrmNQRJ3FmvqmgKwsyu qzZli4eDkHouq/ay5RZKnhurbRxVe80yJ8yTE26AHgZayZUMkLRbTezKaUfkCDD1 Fb2wFmhOj0nfEl4taql2P4du5emFYezMVWy1JKP4y+4i0DQ= =nNY0 -----END PGP SIGNATURE-----