PT-2012-5473 · Xen+2 · Xen+2

Published 2012-10-31 · Updated 2024-06-15 · CVE-2012-4544

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 4.2 and earlier

Description The issue allows local guest administrators to cause a denial of service by consuming domain 0 memory via a crafted kernel or ramdisk, due to the lack of validation of the size of the kernel or ramdisk before or after decompression.

Recommendations For Xen versions 4.2 and earlier, consider implementing size validation for kernels and ramdisks to prevent excessive memory consumption. As a temporary workaround, restrict the ability of local guest administrators to load custom kernels or ramdisks until a proper fix is applied.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-4544

DSA-2636-1

OPENSUSE-SU-2012_1572-1

OPENSUSE-SU-2012_1573-1

OPENSUSE-SU-2024:10196-1

RHSA-2013:0241

RHSA-2013_0241

SUSE-SU-2014_0411-1

Affected Products

Red Hat

Suse

Xen

References · 219

• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1917 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2196 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4368 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4494 · Security Note
• https://osv.dev/vulnerability/CVE-2012-4544 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092050.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0241.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091844.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4554 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6885 · Security Note
• http://secunia.com/advisories/51071 · Vendor Advisory