Vulnerability Details : CVE-2012-5513
The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range.
Vulnerability category: Input validationDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2012-5513
Probability of exploitation activity in the next 30 days: 0.06%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 26 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-5513
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST |
CWE ids for CVE-2012-5513
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-5513
-
http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
[security-announce] SUSE-SU-2014:0470-1: important: Security update for
-
http://lists.opensuse.org/opensuse-updates/2013-04/msg00051.html
openSUSE-SU-2013:0636-1: moderate: xen: security and bugfix update
-
http://security.gentoo.org/glsa/glsa-201309-24.xml
Xen: Multiple vulnerabilities (GLSA 201309-24) — Gentoo security
-
http://www.debian.org/security/2012/dsa-2582
Debian -- Security Information -- DSA-2582-1 xen
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html
[security-announce] SUSE-SU-2012:1615-1: important: Security update for
-
http://support.citrix.com/article/CTX135777
Citrix XenServer Multiple Security Updates
-
http://www.openwall.com/lists/oss-security/2012/12/03/11
oss-security - Xen Security Advisory 29 (CVE-2012-5513) - XENMEM_exchange may overwrite hypervisor memory
-
http://rhn.redhat.com/errata/RHSA-2012-1540.html
RHSA-2012:1540 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
[security-announce] SUSE-SU-2014:0446-1: important: Security update for
-
http://www.securityfocus.com/bid/56797
Xen 'XENMEM_exchange' Local Privilege Escalation Vulnerability
-
http://lists.opensuse.org/opensuse-updates/2013-04/msg00052.html
openSUSE-SU-2013:0637-1: moderate: xen: security and bugfix update
-
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00011.html
[security-announce] openSUSE-SU-2013:0133-1: important: xen to fix vario
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00018.html
[security-announce] openSUSE-SU-2012:1685-1: important: xen to fix vario
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/80482
Xen XENMEM_exchange privilege escalation CVE-2012-5513 Vulnerability Report
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00019.html
[security-announce] openSUSE-SU-2012:1687-1: important: xen to fix vario
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00000.html
[security-announce] SUSE-SU-2012:1606-1: important: Security update for
Products affected by CVE-2012-5513
- cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.3.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.3.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*