National Cyber Awareness System

Vulnerability Summary for CVE-2012-3496

Overview

XENMEM_populate_physmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when translating paging mode is not used, allows local PV OS guest kernels to cause a denial of service (BUG triggered and host crash) via invalid flags such as MEMF_populate_on_demand.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://support.citrix.com/article/CTX134708

Type: Advisory; Patch Information

Hyperlink:http://support.citrix.com/article/CTX134708

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=854590

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=854590

External Source: XF

Name: xen-xenmempopulatephysmap-dos(78267)

Hyperlink:http://xforce.iss.net/xforce/xfdb/78267

External Source: BID

Name: 55412

Hyperlink:http://www.securityfocus.com/bid/55412

External Source: OSVDB

Name: 85200

Hyperlink:http://www.osvdb.org/85200

External Source: MLIST

Name: [oss-security] 20120905 Xen Security Advisory 14 (CVE-2012-3496) - XENMEM_populate_physmap DoS vulnerability

Hyperlink:http://www.openwall.com/lists/oss-security/2012/09/05/7

External Source: DEBIAN

Name: DSA-2544

Hyperlink:http://www.debian.org/security/2012/dsa-2544

External Source: CONFIRM

Name: http://wiki.xen.org/wiki/Security_Announcements#XSA-14_XENMEM_populate_physmap_DoS_vulnerability

Hyperlink:http://wiki.xen.org/wiki/Security_Announcements#XSA-14_XENMEM_populate_physmap_DoS_vulnerability

External Source: SECTRACK

Name: 1027481

Hyperlink:http://securitytracker.com/id?1027481

External Source: SECUNIA

Name: 50530

Type: Advisory

Hyperlink:http://secunia.com/advisories/50530

External Source: SECUNIA

Name: 50472

Type: Advisory

Hyperlink:http://secunia.com/advisories/50472

External Source: MLIST

Name: [Xen-announce] 20120905 Xen Security Advisory 14 (CVE-2012-3496) - XENMEM_populate_physmap DoS vulnerability

Type: Advisory

Hyperlink:http://lists.xen.org/archives/html/xen-announce/2012-09/msg00002.html

External Source: SUSE

Name: openSUSE-SU-2012:1572

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html

External Source: SUSE

Name: openSUSE-SU-2012:1174

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html

External Source: SUSE

Name: openSUSE-SU-2012:1172

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html

External Source: SUSE

Name: SUSE-SU-2012:1162

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html

External Source: SUSE

Name: SUSE-SU-2012:1133

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html

External Source: SUSE

Name: SUSE-SU-2012:1132

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html