Vulnerability Details : CVE-2012-4537
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
Vulnerability category: Denial of service
Products affected by CVE-2012-4537
- cpe:2.3:o:xen:xen:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-4537
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 26 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-4537
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:N/A:P |
3.9
|
2.9
|
NIST |
CWE ids for CVE-2012-4537
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-4537
-
http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
[security-announce] SUSE-SU-2014:0470-1: important: Security update for
-
http://security.gentoo.org/glsa/glsa-201309-24.xml
Xen: Multiple vulnerabilities (GLSA 201309-24) — Gentoo security
-
http://www.debian.org/security/2012/dsa-2582
Debian -- Security Information -- DSA-2582-1 xen
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html
[security-announce] SUSE-SU-2012:1487-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html
[security-announce] SUSE-SU-2012:1615-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
[security-announce] openSUSE-SU-2012:1572-1: important: XEN: security an
-
http://rhn.redhat.com/errata/RHSA-2012-1540.html
RHSA-2012:1540 - Security Advisory - Red Hat Customer Portal
-
http://www.securitytracker.com/id?1027761
Xen Memory Mapping Bug Lets Local Guest Administrative Users Deny Service - SecurityTracker
-
http://www.openwall.com/lists/oss-security/2012/11/13/6
oss-security - Xen Security Advisory 22 (CVE-2012-4537) - Memory mapping failure DoS vulnerability
-
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
[security-announce] SUSE-SU-2014:0446-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
[security-announce] openSUSE-SU-2012:1573-1: important: XEN: security an
-
http://www.securityfocus.com/bid/56498
Xen Multiple Denial of Service Vulnerabilities
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.html
[security-announce] SUSE-SU-2012:1486-1: important: Security update for
-
https://security.gentoo.org/glsa/201604-03
Xen: Multiple vulnerabilities (GLSA 201604-03) — Gentoo security
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/80024
Xen set_p2m_entry() denial of service CVE-2012-4537 Vulnerability Report
-
http://lists.xen.org/archives/html/xen-announce/2012-11/msg00005.html
Xen project Mailing ListVendor Advisory
Jump to