CVE-2012-3494 — Citrix Xenserver vulnerability

CWE-2649 documents8 sources
Severity
2.1LOWNVD
EPSS
0.1%
top 70.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENCitrix Xenserver
Timeline
PublishedNov 23
Latest updateMay 17

Description

The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service (host crash) by writing to the reserved bits of the DR7 debug control register.

CVSS vector

AV:L/AC:L/C:N/I:N/A:PExploitability: 3.9 | Impact: 2.9

Affected Packages3 packages

▶NVDcitrix/xenserver6.0.2
▶Debianxen/xen< 4.1.3-2+3
▶NVDxen/xen4.0.0, 4.1.0, 4.2.0+2

Patches

Patch: support.citrix.com ↗Patch: support.citrix.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-6p48-jg39-2mq7: The set_debugreg hypercall in include/asm-x86/debugreg↗2022-05-17
▶
CVEList
CVE-2012-3494: The set_debugreg hypercall in include/asm-x86/debugreg↗2012-11-23
▶
OSV
CVE-2012-3494: The set_debugreg hypercall in include/asm-x86/debugreg↗2012-11-23
▶

📋Vendor Advisories

3
Citrix
CVE-2012-3494: The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 syst↗2012-11-23
▶
Red Hat
kernel: xen: hypercall set_debugreg vulnerability↗2012-09-05
▶
Debian
CVE-2012-3494: xen - The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4....↗2012
▶

💬Community

2
Bugzilla
CVE-2012-3494 kernel: xen: hypercall set_debugreg vulnerability [fedora-all]↗2012-09-05
▶
Bugzilla
CVE-2012-3494 kernel: xen: hypercall set_debugreg vulnerability↗2012-08-23
▶
CVE-2012-3494 — Citrix Xenserver vulnerability | cvebase