PT-2012-6225 · Xen · Xen

Published 2012-11-23 · Updated 2017-08-29 · CVE-2012-6034

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 4.0 through 4.2

Description The issue concerns the Transcendent Memory (TMEM) in Xen, specifically the tmemc save get next page and tmemc save get next inv functions, as well as the TMEMC SAVE GET POOL UUID sub-operation. These components do not check incoming guest output buffer pointers, allowing local guest OS users to cause a denial of service, resulting in memory corruption and host crash, or execute arbitrary code via unspecified vectors.

Recommendations For Xen versions 4.0 through 4.2, consider disabling the tmemc save get next page and tmemc save get next inv functions, as well as restricting the use of the TMEMC SAVE GET POOL UUID sub-operation, until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-6034

Affected Products

Xen

References · 15

• http://security.gentoo.org/glsa/glsa-201309-24.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-6034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6034 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6034 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-6034 · Vendor Advisory
• http://secunia.com/advisories/50472 · Vendor Advisory
• https://security.gentoo.org/glsa/201604-03 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78268 · Note
• http://openwall.com/lists/oss-security/2012/09/05/8 · Note
• http://osvdb.org/85199 · Note
• http://securityfocus.com/bid/55410 · Note
• http://secunia.com/advisories/55082 · Note
• http://securitytracker.com/id?1027482 · Note
• http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html · Note
• http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities · Note