Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2012-5525 — XEN vulnerability

7 documents6 sources
Severity
4.7MEDIUMNVD
EPSS
6.9%
top 8.59%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
XENDebian XEN
Timeline
PublishedDec 13
Latest updateMay 17

Description

The get_page_from_gfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service (crash) via a crafted GFN that triggers a buffer over-read.

CVSS vector

AV:L/AC:M/C:N/I:N/A:CExploitability: 3.4 | Impact: 6.9

Affected Packages2 packages

▶NVDxen/xen4.2.0
▶debiandebian/xen

🔴Vulnerability Details

1
GHSA
GHSA-wrrw-3jqq-qcvc: The get_page_from_gfn hypercall function in Xen 4↗2022-05-17
▶

💥Exploits & PoCs

1
Metasploit
Linux DoS Xen 4.2.0 2012-5525↗
▶

📋Vendor Advisories

2
Red Hat
kernel: xen: several hypercalls do not validate input GFNs↗2012-12-03
▶
Debian
CVE-2012-5525: xen - The get_page_from_gfn hypercall function in Xen 4.2 allows local PV guest OS adm...↗2012
▶

💬Community

2
Bugzilla
CVE-2012-5525 kernel: xen: several hypercalls do not validate input GFNs [fedora-all]↗2012-12-03
▶
Bugzilla
CVE-2012-5525 kernel: xen: several hypercalls do not validate input GFNs↗2012-11-16
▶