CVE-2012-3498 — Improper Input Validation in Citrix Xenserver

CWE-20 — Improper Input Validation9 documents8 sources
Severity
5.6MEDIUMNVD
EPSS
0.1%
top 79.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENCitrix Xenserver
Timeline
PublishedNov 23
Latest updateMay 17

Description

PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service (host crash) and possibly read hypervisor or guest memory via vectors related to a missing range check of map->index.

CVSS vector

AV:L/AC:L/C:P/I:N/A:CExploitability: 3.9 | Impact: 7.8

Affected Packages3 packages

▶NVDcitrix/xenserver6.0.2
▶Debianxen/xen< 4.1.3-2+3
▶NVDxen/xen4.1.0, 4.2.0+1

🔴Vulnerability Details

3
GHSA
GHSA-2gjh-pw8m-qmpj: PHYSDEVOP_map_pirq in Xen 4↗2022-05-17
▶
OSV
CVE-2012-3498: PHYSDEVOP_map_pirq in Xen 4↗2012-11-23
▶
CVEList
CVE-2012-3498: PHYSDEVOP_map_pirq in Xen 4↗2012-11-23
▶

📋Vendor Advisories

3
Citrix
CVE-2012-3498: PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service (host cras↗2012-11-23
▶
Red Hat
kernel: xen: PHYSDEVOP_map_pirq index vulnerability↗2012-09-05
▶
Debian
CVE-2012-3498: xen - PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier all...↗2012
▶

💬Community

2
Bugzilla
CVE-2012-3498 kernel: xen: PHYSDEVOP_map_pirq index vulnerability [fedora-all]↗2012-09-05
▶
Bugzilla
CVE-2012-3498 kernel: xen: PHYSDEVOP_map_pirq index vulnerability↗2012-08-23
▶
CVE-2012-3498 — Improper Input Validation in Citrix | cvebase