CVE-2012-3497
published 2012-11-23CVE-2012-3497: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in…
PriorityP417medium6.9CVSS 2.0
AVLACMAuNCCICAC
EPSS
0.40%
31.9th percentile
(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.1.4-1 (bookworm) | xen 4.1.4-1 (bookworm) |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.1.4-1 | 4.1.4-1 |
| xen | xen | >= 0 < 4.1.4-1 | 4.1.4-1 |
| xen | xen | >= 0 < 4.1.4-1 | 4.1.4-1 |
| xen | xen | >= 0 < 4.1.4-1 | 4.1.4-1 |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv6.9MEDIUM
vendor_debian6.9LOW
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2012-6031: xen - The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and ...
vendor_debian·2012·CVSS 6.9
CVE-2012-6031 [MEDIUM] CVE-2012-6031: xen - The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and ...
The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Debian
CVE-2012-6036: xen - The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restor...
vendor_debian·2012·CVSS 6.9
CVE-2012-6036 [MEDIUM] CVE-2012-6036: xen - The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restor...
The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or possibly execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Debian
CVE-2012-6032: xen - Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_c...
vendor_debian·2012·CVSS 6.9
CVE-2012-6032 [MEDIUM] CVE-2012-6032: xen - Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_c...
Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (memory corruption and host crash) via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Debian
CVE-2012-6035: xen - The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, ...
vendor_debian·2012·CVSS 6.9
CVE-2012-6035 [MEDIUM] CVE-2012-6035: xen - The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, ...
The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Debian
CVE-2012-6030: xen - The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4...
vendor_debian·2012·CVSS 6.9
CVE-2012-6030 [MEDIUM] CVE-2012-6030: xen - The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4...
The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Debian
CVE-2012-3497: xen - (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_...
vendor_debian·2012·CVSS 6.9
CVE-2012-3497 [MEDIUM] CVE-2012-3497: xen - (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_...
(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Debian
CVE-2012-6033: xen - The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, ...
vendor_debian·2012·CVSS 6.9
CVE-2012-6033 [MEDIUM] CVE-2012-6033: xen - The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, ...
The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Debian
CVE-2012-6034: xen - The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and t...
vendor_debian·2012·CVSS 6.9
CVE-2012-6034 [MEDIUM] CVE-2012-6034: xen - The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and t...
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Red Hat
CVE-2012-6036: The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4
vendor_redhat·CVSS 6.9
CVE-2012-6036 [MEDIUM] CVE-2012-6036: The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4
The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or possibly execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support f
Red Hat
CVE-2012-6031: The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4
vendor_redhat·CVSS 6.9
CVE-2012-6031 [MEDIUM] CVE-2012-6031: The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Red Hat
CVE-2012-6032: Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4
vendor_redhat·CVSS 6.9
CVE-2012-6032 [MEDIUM] CVE-2012-6032: Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4
Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (memory corruption and host crash) via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Red Hat
CVE-2012-6035: The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4
vendor_redhat·CVSS 6.9
CVE-2012-6035 [MEDIUM] CVE-2012-6035: The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Red Hat
CVE-2012-3497: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TM
vendor_redhat·CVSS 6.9
CVE-2012-3497 [MEDIUM] CVE-2012-3497: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TM
(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Red Hat
CVE-2012-6030: The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4
vendor_redhat·CVSS 6.9
CVE-2012-6030 [MEDIUM] CVE-2012-6030: The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Red Hat
CVE-2012-6033: The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4
vendor_redhat·CVSS 6.9
CVE-2012-6033 [MEDIUM] CVE-2012-6033: The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Red Hat
CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
vendor_redhat·CVSS 6.9
CVE-2012-6034 [MEDIUM] CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise
GHSA
GHSA-vqpw-3pfq-73hh: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2012-6034 [MEDIUM] CWE-20 GHSA-vqpw-3pfq-73hh: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
GHSA
GHSA-vx34-5jq7-vqc8: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TM
ghsa_unreviewed·2022-05-17
CVE-2012-3497 [MEDIUM] CWE-20 GHSA-vx34-5jq7-vqc8: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TM
(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.
GHSA
GHSA-p542-pm63-7qpp: The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2012-6033 [MEDIUM] GHSA-p542-pm63-7qpp: The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
GHSA
GHSA-jvrg-jfpg-gqx8: The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2012-6031 [MEDIUM] CWE-20 GHSA-jvrg-jfpg-gqx8: The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
GHSA
GHSA-7c3m-cjc4-58wg: Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2012-6032 [MEDIUM] GHSA-7c3m-cjc4-58wg: Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4
Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (memory corruption and host crash) via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
GHSA
GHSA-4m7r-jfv6-r27r: The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2012-6036 [MEDIUM] GHSA-4m7r-jfv6-r27r: The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4
The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or possibly execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
GHSA
GHSA-v379-6hwf-84m7: The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2012-6030 [MEDIUM] CWE-20 GHSA-v379-6hwf-84m7: The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
GHSA
GHSA-h633-xqc8-99wj: The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2012-6035 [MEDIUM] CWE-20 GHSA-h633-xqc8-99wj: The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
OSV
CVE-2012-3497: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TM
osv·2012-11-23·CVSS 6.9
CVE-2012-3497 [MEDIUM] CVE-2012-3497: (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TM
(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.
OSV
CVE-2012-6030: The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4
osv·2012-11-23·CVSS 6.9
CVE-2012-6030 [MEDIUM] CVE-2012-6030: The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
OSV
CVE-2012-6033: The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4
osv·2012-11-23·CVSS 6.9
CVE-2012-6033 [MEDIUM] CVE-2012-6033: The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
OSV
CVE-2012-6032: Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4
osv·2012-11-23·CVSS 6.9
CVE-2012-6032 [MEDIUM] CVE-2012-6032: Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4
Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (memory corruption and host crash) via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
OSV
CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
osv·2012-11-23·CVSS 6.9
CVE-2012-6034 [MEDIUM] CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
OSV
CVE-2012-6035: The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4
osv·2012-11-23·CVSS 6.9
CVE-2012-6035 [MEDIUM] CVE-2012-6035: The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
OSV
CVE-2012-6036: The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4
osv·2012-11-23·CVSS 6.9
CVE-2012-6036 [MEDIUM] CVE-2012-6036: The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4
The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or possibly execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
OSV
CVE-2012-6031: The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4
osv·2012-11-23·CVSS 6.9
CVE-2012-6031 [MEDIUM] CVE-2012-6031: The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4
The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.htmlhttp://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.htmlhttp://osvdb.org/85199http://secunia.com/advisories/50472http://secunia.com/advisories/51324http://secunia.com/advisories/51352http://secunia.com/advisories/51413http://secunia.com/advisories/55082http://security.gentoo.org/glsa/glsa-201309-24.xmlhttp://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilitieshttp://www.openwall.com/lists/oss-security/2012/09/05/8http://www.securityfocus.com/bid/55410http://www.securitytracker.com/id?1027482https://exchange.xforce.ibmcloud.com/vulnerabilities/78268https://security.gentoo.org/glsa/201604-03http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.htmlhttp://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.htmlhttp://osvdb.org/85199http://secunia.com/advisories/50472http://secunia.com/advisories/51324http://secunia.com/advisories/51352http://secunia.com/advisories/51413http://secunia.com/advisories/55082http://security.gentoo.org/glsa/glsa-201309-24.xmlhttp://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilitieshttp://www.openwall.com/lists/oss-security/2012/09/05/8http://www.securityfocus.com/bid/55410http://www.securitytracker.com/id?1027482https://exchange.xforce.ibmcloud.com/vulnerabilities/78268https://security.gentoo.org/glsa/201604-03
2012-11-23
Published