CVE catalog

CVE-2022-42312

xen affected and fixed versions

Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction

Severity: Medium · CVSS 6CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Published: Nov 1, 2022, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 27, 2026

Projects and upstream resources

[xen][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	xen	`4.20.4+39-gf1e1321c87-0+deb13u1`	Fixed	[CVE-2022-42312]
Debiantrixie	xen	`4.16.2+90-g0d39a6d1ae-1`	FixedDistribution-reported fixed boundary	[CVE-2022-42312]
Debiantrixie	xen	`4.20.3+127-gc42374a105-0+deb13u1`	Fixed	[CVE-2022-42312]
Debiansid	xen	`4.16.2+90-g0d39a6d1ae-1`	FixedDistribution-reported fixed boundary	[CVE-2022-42312]
Debiansid	xen	`4.20.4+39-gf1e1321c87-1`	Fixed	[CVE-2022-42312]
Debianforky	xen	`4.16.2+90-g0d39a6d1ae-1`	FixedDistribution-reported fixed boundary	[CVE-2022-42312]
Debianforky	xen	`4.20.4+39-gf1e1321c87-1`	Fixed	[CVE-2022-42312]
Debianbookworm-security	xen	`4.17.7-0+deb12u1`	Fixed	[CVE-2022-42312]
Debianbookworm	xen	`4.16.2+90-g0d39a6d1ae-1`	FixedDistribution-reported fixed boundary	[CVE-2022-42312]
Debianbookworm	xen	`4.17.5+72-g01140da4e8-1`	Fixed	[CVE-2022-42312]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	xen	`4.16.2+90-g0d39a6d1ae-1`	FixedDistribution-reported fixed boundary	[CVE-2022-42312]
Debianbookworm	xen	`4.17.5+72-g01140da4e8-1`	Fixed	[CVE-2022-42312]
Debianbookworm-security	xen	`4.17.7-0+deb12u1`	Fixed	[CVE-2022-42312]
Debianforky	xen	`4.16.2+90-g0d39a6d1ae-1`	FixedDistribution-reported fixed boundary	[CVE-2022-42312]
Debianforky	xen	`4.20.4+39-gf1e1321c87-1`	Fixed	[CVE-2022-42312]
Debiansid	xen	`4.16.2+90-g0d39a6d1ae-1`	FixedDistribution-reported fixed boundary	[CVE-2022-42312]
Debiansid	xen	`4.20.4+39-gf1e1321c87-1`	Fixed	[CVE-2022-42312]
Debiantrixie	xen	`4.16.2+90-g0d39a6d1ae-1`	FixedDistribution-reported fixed boundary	[CVE-2022-42312]
Debiantrixie	xen	`4.20.3+127-gc42374a105-0+deb13u1`	Fixed	[CVE-2022-42312]
Debiantrixie-security	xen	`4.20.4+39-gf1e1321c87-0+deb13u1`	Fixed	[CVE-2022-42312]

Original provider fields

{
  "package_releases": [
    {
      "name": "xen",
      "status": "fixed",
      "release": "sid",
      "version": "4.20.4+39-gf1e1321c87-1"
    },
    {
      "name": "xen",
      "status": "fixed",
      "release": "forky",
      "version": "4.20.4+39-gf1e1321c87-1"
    },
    {
      "name": "xen",
      "status": "fixed",
      "release": "trixie",
      "version": "4.20.3+127-gc42374a105-0+deb13u1"
    },
    {
      "name": "xen",
      "status": "fixed",
      "release": "trixie-security",
      "version": "4.20.4+39-gf1e1321c87-0+deb13u1"
    },
    {
      "name": "xen",
      "status": "fixed",
      "release": "bookworm",
      "version": "4.17.5+72-g01140da4e8-1"
    },
    {
      "name": "xen",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "4.17.7-0+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "xen",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "4.16.2+90-g0d39a6d1ae-1"
    },
    {
      "bug": null,
      "name": "xen",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "4.16.2+90-g0d39a6d1ae-1"
    },
    {
      "bug": null,
      "name": "xen",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "4.16.2+90-g0d39a6d1ae-1"
    },
    {
      "bug": null,
      "name": "xen",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "4.16.2+90-g0d39a6d1ae-1"
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libxencall1]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxen-dev]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxendevicemodel1]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxenevtchn1]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxenforeignmemory1]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxengnttab1]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxenhypfs1]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxenmisc4.17]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxenstore4]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxentoolcore1]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[libxentoollog1]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xen-doc]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xen-hypervisor-4.17-amd64]Unknown
Source package: [xen]
Details (2)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xen-hypervisor-4.17-amd64-dbg]Unknown
Source package: [xen]
Details (2)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xen-hypervisor-4.17-arm64]Unknown
Source package: [xen]
Details (2)
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xen-hypervisor-4.17-arm64-dbg]Unknown
Source package: [xen]
Details (2)
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xen-hypervisor-common]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xenstore-utils]Unknown
Source package: [xen]
Details (4)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xen-system-amd64]Unknown
Source package: [xen]
Details (2)
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · amd64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
[xen-system-arm64]Unknown
Source package: [xen]
Details (2)
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm
- 4.17.5+72-g01140da4e8-1 · arm64 · bookworm-security
  Unknown · Fixed: 4.16.2+90-g0d39a6d1ae-1
  Version impact unknown
  dsa · xen · debian · bookworm

Next results

Observed: Oct 29, 2026, 11:40:19 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [SUSE security advisories and VEX]