CVE-2012-6034
published 2012-11-23CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM)…
PriorityP421medium4.4CVSS 2.0
AVLACMAuNCPIPAP
EPSS
0.43%
34.9th percentile
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.1.4-1 (bookworm) | xen 4.1.4-1 (bookworm) |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.1.4-1 | 4.1.4-1 |
| xen | xen | >= 0 < 4.1.4-1 | 4.1.4-1 |
| xen | xen | >= 0 < 4.1.4-1 | 4.1.4-1 |
| xen | xen | >= 0 < 4.1.4-1 | 4.1.4-1 |
CVSS provenance
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv6.9MEDIUM
vendor_debian6.9LOW
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vqpw-3pfq-73hh: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2012-6034 [MEDIUM] CWE-20 GHSA-vqpw-3pfq-73hh: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
OSV
CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
osv·2012-11-23·CVSS 6.9
CVE-2012-6034 [MEDIUM] CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Debian
CVE-2012-6034: xen - The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and t...
vendor_debian·2012·CVSS 6.9
CVE-2012-6034 [MEDIUM] CVE-2012-6034: xen - The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and t...
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Scope: local
bookworm: resolved (fixed in 4.1.4-1)
bullseye: resolved (fixed in 4.1.4-1)
forky: resolved (fixed in 4.1.4-1)
sid: resolved (fixed in 4.1.4-1)
trixie: resolved (fixed in 4.1.4-1)
Red Hat
CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
vendor_redhat·CVSS 6.9
CVE-2012-6034 [MEDIUM] CVE-2012-6034: The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memo
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Statement: Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 because we did not support TMEM (Transcendent Memory).
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise
No detection rules found.
No public exploits indexed.
http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.htmlhttp://osvdb.org/85199http://secunia.com/advisories/50472http://secunia.com/advisories/55082http://security.gentoo.org/glsa/glsa-201309-24.xmlhttp://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilitieshttp://www.openwall.com/lists/oss-security/2012/09/05/8http://www.securityfocus.com/bid/55410http://www.securitytracker.com/id?1027482https://exchange.xforce.ibmcloud.com/vulnerabilities/78268https://security.gentoo.org/glsa/201604-03http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.htmlhttp://osvdb.org/85199http://secunia.com/advisories/50472http://secunia.com/advisories/55082http://security.gentoo.org/glsa/glsa-201309-24.xmlhttp://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilitieshttp://www.openwall.com/lists/oss-security/2012/09/05/8http://www.securityfocus.com/bid/55410http://www.securitytracker.com/id?1027482https://exchange.xforce.ibmcloud.com/vulnerabilities/78268https://security.gentoo.org/glsa/201604-03
2012-11-23
Published