CVE-2012-3496 — Citrix Xenserver vulnerability

CWE-169 documents8 sources
Severity
4.7MEDIUMNVD
EPSS
0.1%
top 73.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENCitrix Xenserver
Timeline
PublishedNov 23
Latest updateMay 17

Description

XENMEM_populate_physmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when translating paging mode is not used, allows local PV OS guest kernels to cause a denial of service (BUG triggered and host crash) via invalid flags such as MEMF_populate_on_demand.

CVSS vector

AV:L/AC:M/C:N/I:N/A:CExploitability: 3.4 | Impact: 6.9

Affected Packages3 packages

▶NVDcitrix/xenserver6.0.2
▶Debianxen/xen< 4.1.3-2+3
▶NVDxen/xen4.0.0, 4.1.0, 4.2.0+2

Patches

Patch: support.citrix.com ↗Patch: support.citrix.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-gw25-hcr4-7p5h: XENMEM_populate_physmap in Xen 4↗2022-05-17
▶
CVEList
CVE-2012-3496: XENMEM_populate_physmap in Xen 4↗2012-11-23
▶
OSV
CVE-2012-3496: XENMEM_populate_physmap in Xen 4↗2012-11-23
▶

📋Vendor Advisories

3
Citrix
CVE-2012-3496: XENMEM_populate_physmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when translating paging mode is not used, allows local PV OS↗2012-11-23
▶
Red Hat
kernel: xen: XENMEM_populate_physmap DoS vulnerability↗2012-09-05
▶
Debian
CVE-2012-3496: xen - XENMEM_populate_physmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and...↗2012
▶

💬Community

2
Bugzilla
CVE-2012-3496 kernel: xen: XENMEM_populate_physmap DoS vulnerability [fedora-all]↗2012-09-05
▶
Bugzilla
CVE-2012-3496 kernel: xen: XENMEM_populate_physmap DoS vulnerability↗2012-08-23
▶
CVE-2012-3496 — Citrix Xenserver vulnerability | cvebase