xen: Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision
CVE-2022-42324 is fixed in xen on 1 platform, first by DEBIAN-CVE-2022-42324, released November 1, 2022. It is not reported as exploited. Patch Radar priority: Routine.
Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the xenstore ring.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| xen · Debian 12.15 (bookworm) | 4.16.2+90-g0d39a6d1ae-1 | DEBIAN-CVE-2022-42324 | Nov 1, 2022 |
| xen · Debian 13.5 (trixie) | 4.16.2+90-g0d39a6d1ae-1 | DEBIAN-CVE-2022-42324 | Nov 1, 2022 |
| xen · Debian 14 | 4.16.2+90-g0d39a6d1ae-1 | DEBIAN-CVE-2022-42324 | Nov 1, 2022 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.