CVE-2012-6035

The CVE-2012-6035 entry concerns Xen’s Transcendent Memory (TMEM) in Xen 4.0–4.2, where do_tmem_destroy_pool does not properly validate pool IDs. This can lead to denial of service (memory corruption and host crash) and could allow arbitrary code execution via unspecified vectors. The description...

CVE-2012-6030

The dotmemop function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service host crash and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was...

CVE-2012-6034

The 1 tmemcsavegetnextpage and 2 tmemcsavegetnextinv functions and the 3 TMEMCSAVEGETPOOLUUID sub-operation in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service memory corrupti...

CVE-2012-6033

The dotmemcontrol function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too...

CVE-2012-6032

Multiple integer overflows in the 1 tmhcopyfromclient and 2 tmhcopytoclient functions in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service memory corruption and host crash via unspecified vectors. NOTE: this issue was originally publishe...

CVE-2012-6033

Technical details for CVE-2012-6033 are not provided in the connected documents. The initial description notes a privilege check flaw in Xen TMEM, but no specifics on affected versions, impact, or fixes are available here. Monitor for updates.

CVE-2012-6034

CVE-2012-6034 affects Xen TMEM (Transcendent Memory) in Xen 4.0–4.2. The vulnerable code paths are tmemc_save_get_next_page, tmemc_save_get_next_inv, and the TMEMC_SAVE_GET_POOL_UUID sub-operation, which fail to validate incoming guest output buffer pointers. This can allow a local guest OS user ...

CVE-2012-3497: Improper Input Validation

1 TMEMCSAVEGETCLIENTWEIGHT, 2 TMEMCSAVEGETCLIENTCAP, 3 TMEMCSAVEGETCLIENTFLAGS and 4 TMEMCSAVEEND in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service NULL pointer dereference or memory corruption and host crash or possibly have other...

CVE-2012-6036: Undefined Security Weakness

The 1 memcsavegetnextpage, 2 tmemcrestoreputpage and 3 tmemcrestoreflushpage functions in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service memory corruption and host crash or possibly execute...

CVE-2012-6032: Undefined Security Weakness

Multiple integer overflows in the 1 tmhcopyfromclient and 2 tmhcopytoclient functions in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service memory corruption and host crash via unspecified vectors. NOTE: this issue was originally publishe...

CVE-2012-6031: Improper Input Validation

The dotmemget function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service CPU hang and host crash via unspecified vectors related to a spinlock being held in the "badcopy error path." NOTE: this issue was originally published as part o...

CVE-2012-6033: Undefined Security Weakness

The dotmemcontrol function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too...

CVE-2012-6034: Improper Input Validation

The 1 tmemcsavegetnextpage and 2 tmemcsavegetnextinv functions and the 3 TMEMCSAVEGETPOOLUUID sub-operation in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service memory corrupti...

multiple TMEM hypercall vulnerabilities

ISSUE DESCRIPTION Several sub-operations of the Transcendent Memory TMEM hypercall either do not correctly validate their inputs, do not correctly validate the privilege of the calling guest, or have other security-relevant bugs. A full list of the vulnerabilities in the TMEM system is not...