PT-2012-5470 · Xen+1 · Xen+1

Published 2012-11-21 · Updated 2024-06-15 · CVE-2012-4539

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 4.0 through 4.2

Description The issue allows local guest OS administrators to cause a denial of service, resulting in an infinite loop and hang or crash, by providing invalid arguments to the GNTTABOP get status frames hypercall.

Recommendations For Xen versions 4.0 through 4.2, as a temporary workaround, consider restricting the use of the GNTTABOP get status frames hypercall until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2012-4539

DSA-2582-1

OPENSUSE-SU-2012_1572-1

OPENSUSE-SU-2012_1573-1

OPENSUSE-SU-2024:10196-1

Affected Products

Suse

Xen

References · 186

• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4539 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4539 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4539 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00018.html · Vendor Advisory
• http://debian.org/security/2012/dsa-2582 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.html · Vendor Advisory
• https://security.gentoo.org/glsa/201604-03 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201309-24.xml · Vendor Advisory
• http://lists.xen.org/archives/html/xen-announce/2012-11/msg00002.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4539 · Security Note