PT-2012-4760 · Citrix+2 · Xenserver+2

Matthew Daley · Published 2012-09-14 · Updated 2017-07-01 · CVE-2012-3495

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.1.x Citrix XenServer version 6.0.2 and earlier

Description The issue allows guest OS users to cause a denial of service and possibly gain privileges via unspecified vectors. This is due to the physdev get free pirq hypercall in arch/x86/physdev.c using the return value of the get free pirq function as an array index without checking for error indications, leading to an invalid memory write and host crash.

Recommendations For Xen versions 4.1.x, update to a version that includes a fix for this issue. For Citrix XenServer version 6.0.2 and earlier, update to a version that includes a fix for this issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-3495

OPENSUSE-SU-2012_1172-1

OPENSUSE-SU-2012_1572-1

OPENSUSE-SU-2012_1573-1

Affected Products

Suse

Xen

Xenserver

References · 68

• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html · Vendor Advisory
• https://security.gentoo.org/glsa/201604-03 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04588 · Security Note
• http://security.gentoo.org/glsa/glsa-201309-24.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3495 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3495 · Security Note
• https://osv.dev/vulnerability/CVE-2012-3495 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3495 · Vendor Advisory
• https://bugzilla.novell.com/778105 · Note
• http://support.novell.com/security/cve/CVE-2012-3515.html · Note
• http://support.novell.com/security/cve/CVE-2012-3433.html · Note