MediumFix available
xen — security advisory
Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.
- Products
- xen
- Affected versions
- Not specified
- Fixed versions
- 4.15.4-r0, 4.16.3-r0, 4.17.0-r0
- CVEs
- CVE-2022-42310
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:18 UTC · Revision 1
Source evidence
Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.
osv:ALPINE-CVE-2022-42310
xen
Fixed versions: 4.15.4-r0
xen
Fixed versions: 4.15.4-r0
xen
Fixed versions: 4.16.3-r0
xen
Fixed versions: 4.16.3-r0
xen
Fixed versions: 4.17.0-r0
xen
Fixed versions: 4.17.0-r0
xen
Fixed versions: 4.17.0-r0
xen
Fixed versions: 4.17.0-r0
xen
Fixed versions: 4.17.0-r0
xen
Fixed versions: 4.17.0-r0
xen
Fixed versions: 4.17.0-r0
Complete source record
{
"id": "0ca833aab0160717a611ae0bf2a2f2036af691c46cfa733dadcebd740436c890",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2022-42310",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2022-42310",
"summary": "Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base.",
"evidence": "osv:ALPINE-CVE-2022-42310",
"products": [
{
"name": {
"value": "xen",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.4-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.15.4-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.16.3-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.16.3-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.17.0-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.17.0-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.17.0-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.17.0-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.17.0-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.17.0-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xen",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.17.0-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "ALPINE-CVE-2022-42310",
"aliases": [
"ALPINE-CVE-2022-42310"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.15.4-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.15.4-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.16.3-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.16.3-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.17.0-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.17.0-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.17.0-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.17.0-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.17.0-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.17.0-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.9.0"
},
{
"fixed": "4.17.0-r0"
}
]
}
],
"package": {
"name": "xen",
"purl": "pkg:apk/alpine/xen?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-42310.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-15T07:17:54.257569653Z",
"provider": "osv",
"upstream": [
"CVE-2022-42310"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2022-42310"
]
},
"related_cves": [
{
"value": "CVE-2022-42310",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 321982,
"published_at": "2022-11-01T13:15:11.3+00:00"
}