Vulnerability Details : CVE-2012-4538
The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2012-4538
- cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-4538
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 26 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-4538
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:N/I:N/A:C |
3.9
|
6.9
|
NIST |
CWE ids for CVE-2012-4538
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-4538
-
http://security.gentoo.org/glsa/glsa-201309-24.xml
Xen: Multiple vulnerabilities (GLSA 201309-24) — Gentoo security
-
http://www.openwall.com/lists/oss-security/2012/11/13/3
oss-security - Xen Security Advisory 23 (CVE-2012-4538) - Unhooking empty PAE entries DoS vulnerability
-
http://www.debian.org/security/2012/dsa-2582
Debian -- Security Information -- DSA-2582-1 xen
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html
[security-announce] SUSE-SU-2012:1487-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html
[security-announce] SUSE-SU-2012:1615-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
[security-announce] openSUSE-SU-2012:1572-1: important: XEN: security an
-
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
[security-announce] SUSE-SU-2014:0446-1: important: Security update for
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
[security-announce] openSUSE-SU-2012:1573-1: important: XEN: security an
-
http://www.securitytracker.com/id?1027762
Xen HVMOP_pagetable_dying() Bug Lets Local Users Deny Service - SecurityTracker
-
http://www.securityfocus.com/bid/56498
Xen Multiple Denial of Service Vulnerabilities
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.html
[security-announce] SUSE-SU-2012:1486-1: important: Security update for
-
https://security.gentoo.org/glsa/201604-03
Xen: Multiple vulnerabilities (GLSA 201604-03) — Gentoo security
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/80025
Xen HVMOP_pagetable_dying() denial of service CVE-2012-4538 Vulnerability Report
-
http://lists.xen.org/archives/html/xen-announce/2012-11/msg00004.html
Xen project Mailing ListVendor Advisory
Jump to