DEBIAN-CVE-2012-3498

PHYSDEVOPmappirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service host crash and possibly read hypervisor or guest memory via vectors related to a missing range check of map-index...

Null pointer dereference

1 TMEMCSAVEGETCLIENTWEIGHT, 2 TMEMCSAVEGETCLIENTCAP, 3 TMEMCSAVEGETCLIENTFLAGS and 4 TMEMCSAVEEND in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service NULL pointer dereference or memory corruption and host crash or possibly have other...

Memory corruption

The 1 memcsavegetnextpage, 2 tmemcrestoreputpage and 3 tmemcrestoreflushpage functions in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service memory corruption and host crash or possibly execute...

Design/Logic Flaw

The dotmemget function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service CPU hang and host crash via unspecified vectors related to a spinlock being held in the "badcopy error path." NOTE: this issue was originally published as part o...

Memory corruption

The dotmemdestroypool function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service memory corruption and host crash or execute arbitrary code via unspecified vectors. NOTE: this issue was...

CVE-2012-3497

1 TMEMCSAVEGETCLIENTWEIGHT, 2 TMEMCSAVEGETCLIENTCAP, 3 TMEMCSAVEGETCLIENTFLAGS and 4 TMEMCSAVEEND in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service NULL pointer dereference or memory corruption and host crash or possibly have other...

Memory corruption

The GNTTABOPswapgrantref sub-operation in the grant table hypercall in Xen 4.2 and Citrix XenServer 6.0.2 allows local guest kernels or administrators to cause a denial of service host crash and possibly gain privileges via a crafted grant reference that triggers a write to an arbitrary hyperviso...

Memory corruption

The 1 tmemcsavegetnextpage and 2 tmemcsavegetnextinv functions and the 3 TMEMCSAVEGETPOOLUUID sub-operation in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service memory corrupti...

CVE-2012-3496

XENMEMpopulatephysmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when translating paging mode is not used, allows local PV OS guest kernels to cause a denial of service BUG triggered and host crash via invalid flags such as MEMFpopulateondemand...

Design/Logic Flaw

The dotmemop function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service host crash and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was...

CVE-2012-3516

The GNTTABOPswapgrantref sub-operation in the grant table hypercall in Xen 4.2 and Citrix XenServer 6.0.2 allows local guest kernels or administrators to cause a denial of service host crash and possibly gain privileges via a crafted grant reference that triggers a write to an arbitrary hyperviso...

CVE-2012-6030

The dotmemop function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service host crash and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was...

CVE-2012-6031

The dotmemget function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service CPU hang and host crash via unspecified vectors related to a spinlock being held in the "badcopy error path." NOTE: this issue was originally published as part o...

CVE-2012-6034

The 1 tmemcsavegetnextpage and 2 tmemcsavegetnextinv functions and the 3 TMEMCSAVEGETPOOLUUID sub-operation in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service memory corrupti...

Integer overflow

Multiple integer overflows in the 1 tmhcopyfromclient and 2 tmhcopytoclient functions in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service memory corruption and host crash via unspecified vectors. NOTE: this issue was originally publishe...

Design/Logic Flaw

The setdebugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service host crash by writing to the reserved bits of the DR7 debug control register...

CVE-2012-6032

Technical details for CVE-2012-6032 are not present in the provided connected documents. Public information about affected components, root cause, impact or fixes is not available here; monitor for updates.

CVE-2012-6033

The dotmemcontrol function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too...

CVE-2012-3516

The GNTTABOPswapgrantref sub-operation in the grant table hypercall in Xen 4.2 and Citrix XenServer 6.0.2 allows local guest kernels or administrators to cause a denial of service host crash and possibly gain privileges via a crafted grant reference that triggers a write to an arbitrary hyperviso...

CVE-2012-6034

The 1 tmemcsavegetnextpage and 2 tmemcsavegetnextinv functions and the 3 TMEMCSAVEGETPOOLUUID sub-operation in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service memory corrupti...