PT-2012-2409 · Xen+1 · Xen+1

Published 2012-12-03 · Updated 2013-10-11 · CVE-2012-0218

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 3.4 through 4.1

Description The issue allows local PV guest OS users to cause a denial of service by triggering an exception that would normally be handled within Xen, due to a failure to properly clear a flag for exception injection when injecting a General Protection Fault. This occurs when the guest OS has not registered a handler for a syscall or sysenter instruction.

Recommendations For Xen versions 3.4 through 4.1, consider temporarily disabling the handling of unregistered syscalls or sysenter instructions as a quick mitigation measure until a patch is available. Restrict access to the vulnerable functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2012-0218

DSA-2501-1

Affected Products

Suse

Xen

References · 8

• http://security.gentoo.org/glsa/glsa-201309-24.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0218 · Vendor Advisory
• http://lists.xen.org/archives/html/xen-announce/2012-06/msg00003.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0218 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-0218 · Vendor Advisory
• http://debian.org/security/2012/dsa-2501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0218 · Security Note
• http://secunia.com/advisories/55082 · Note