Lucene search

[email protected]CVE-2012-3494

HistoryNov 23, 2012 - 8:55 p.m.

CVE-2012-3494

2012-11-2320:55:00

CWE-264

[email protected]

web.nvd.nist.gov

xen

citrix xenserver

cve-2012-3494

vulnerability

os guest users

denial of service

dr7 debug control register

nvd

8.5 High

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

27.1%

JSON

The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service (host crash) by writing to the reserved bits of the DR7 debug control register.

CPENameOperatorVersion
xen:xenxeneq4.1.0
xen:xenxeneq4.0.0
xen:xenxeneq4.2.0
citrix:xenservercitrix xenserverle6.0.2

CPE	Name	Operator	Version
xen:xen	xen	eq	4.1.0
xen:xen	xen	eq	4.0.0
xen:xen	xen	eq	4.2.0
citrix:xenserver	citrix xenserver	le	6.0.2

References

lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html

lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html

lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html

lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html

lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html

lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html

lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html

lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html

lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html

lists.xen.org/archives/html/xen-announce/2012-09/msg00000.html

osvdb.org/85197

secunia.com/advisories/50472

secunia.com/advisories/50530

secunia.com/advisories/51413

secunia.com/advisories/55082

security.gentoo.org/glsa/glsa-201309-24.xml

support.citrix.com/article/CTX134708

wiki.xen.org/wiki/Security_Announcements#XSA-12_hypercall_set_debugreg_vulnerability

www.debian.org/security/2012/dsa-2544

www.openwall.com/lists/oss-security/2012/09/05/5

www.securityfocus.com/bid/55400

www.securitytracker.com/id?1027479

bugzilla.redhat.com/show_bug.cgi?id=851139

exchange.xforce.ibmcloud.com/vulnerabilities/78265

security.gentoo.org/glsa/201604-03

8.5 High

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

27.1%

JSON

Related for CVE-2012-3494

prion1 ubuntucve1 debiancve1 suse9 openvas57 debian1 nessus16 osv1 fedora20 gentoo2