Xen Security Advisory 421 v2 (CVE-2022-42325,CVE-2022-42326) - Xenstore: Guests can create arbitrary number of nodes via transactions

[Xen.org security team <security@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

     Xen Security Advisory CVE-2022-42325,CVE-2022-42326 / XSA-421
                               version 2

 Xenstore: Guests can create arbitrary number of nodes via transactions

UPDATES IN VERSION 2
====================

Fix typo in title.

Public release.

ISSUE DESCRIPTION
=================

In case a node has been created in a transaction and it is later
deleted in the same transaction, the transaction will be terminated
with an error.

As this error is encountered only when handling the deleted node at
transaction finalization, the transaction will have been performed
partially and without updating the accounting information.  This will
enable a malicious guest to create arbitrary number of nodes.

IMPACT
======

A malicious guest can cause memory shortage in xenstored, resulting in
a Denial of Service (DoS) of xenstored.

This will inhibit creating new guests and changing the configuration
of already running guests.

VULNERABLE SYSTEMS
==================

All systems running Xen version 4.9 and newer are affected.

Only systems running the C variant of Xenstore (xenstored or xenstore-
stubdom) are vulnerable.

Systems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable.

MITIGATION
==========

Running oxenstored instead of xenstored will avoid the vulnerability.

CREDITS
=======

This issue was discovered by Julien Grall of Amazon.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa421/xsa421-??.patch           xen-unstable, Xen 4.16.x
xsa421/xsa421-4.15-??.patch      Xen 4.15.x - 4.13.x

$ sha256sum xsa421* xsa421*/*
c2184bfb9f84220c648531e1ba13a1db0533019c999622e605a6000393e97e65  xsa421.meta
eb2c5ef828e75c79a5f2eb3274a191d3b5d13107db792b8ba2b664ef335a738e  
xsa421/xsa421-01.patch
50532ad32975fdaa2674e454da125d5d44d5b471f3cf7c91f24d4128e2e4d090  
xsa421/xsa421-02.patch
7ea5a47c293fd2379ec99ef88e29d4a19f03221aa731a600da510f61ff702be9  
xsa421/xsa421-4.15-01.patch
8198a41789ed2c63f79f64ea491d9ebbf6d31b78a47e0ff0bbf3db8257fc5f39  
xsa421/xsa421-4.15-02.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.


(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmNg+7IMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZgUUH/19VNMAsM8ROQ/MWuba28+8Y7iwwi/+fg5byAefj
vsQp+VfTODpvfQDngfqt43LhzHZ2YnUJqvsvteDiQKRrLtqakR5xrfAN5pNnzv8Q
PJQfIlsaxyVbeUWdsc2BPuQIdPi9hGGxVjpxTfLNSpbIk0E7pXzeztQKW7buxERv
vFLh358t2FBXXwpMD9qFHcTZX+tz9nVg9/0/POoiBb/7LKrmNQRJ3FmvqmgKwsyu
qzZli4eDkHouq/ay5RZKnhurbRxVe80yJ8yTE26AHgZayZUMkLRbTezKaUfkCDD1
Fb2wFmhOj0nfEl4taql2P4du5emFYezMVWy1JKP4y+4i0DQ=
=nNY0
-----END PGP SIGNATURE-----

Attachment: xsa421.meta
Description: Binary data

Attachment: xsa421/xsa421-01.patch
Description: Binary data

Attachment: xsa421/xsa421-02.patch
Description: Binary data

Attachment: xsa421/xsa421-4.15-01.patch
Description: Binary data

Attachment: xsa421/xsa421-4.15-02.patch
Description: Binary data