Xen Integer Truncation memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in Xen. Affected by this vulnerability is an unknown functionality of the component Integer Truncation Handler. This manipulation causes memory corruption. This vulnerability is handled as CVE-2022-42324. There is not any exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Xen (Virtualization Software) (affected version not known). It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component Integer Truncation Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.

The weakness was released 11/01/2022. The advisory is shared at xenbits.xen.org. This vulnerability is known as CVE-2022-42324 since 10/03/2022. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 211096 (Fedora 37 : xen (2022-9f51d13fa3)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (211096). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Xen

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion