NVD

Id
45087  
Name
CVE-2012-3495  
Description
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
6.1  
Severity
Medium  
CVSS Base Score
6.1  
CVSS Impact Subscore
8.5  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:C)  
Pub Date
2017-01-19  
Published
2012-11-23  
Modified Date
2014-05-05  
Seq
2012-3495  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
226130 45087 CVE-2012-3495 SUSE-SU-2012:1132  View
226131 45087 CVE-2012-3495 SUSE-SU-2012:1133  View
226132 45087 CVE-2012-3495 openSUSE-SU-2012:1172  View
226133 45087 CVE-2012-3495 openSUSE-SU-2012:1572  View
226134 45087 CVE-2012-3495 openSUSE-SU-2012:1573  View
226135 45087 CVE-2012-3495 [Xen-announce] 20120905 Xen Security Advisory 13 (CVE-2012-3495) - hypercall physdev_get_free_pirq vulnerability  View
226136 45087 CVE-2012-3495 GLSA-201309-24  View
226137 45087 CVE-2012-3495 http://support.citrix.com/article/CTX134708  View
226138 45087 CVE-2012-3495 http://wiki.xen.org/wiki/Security_Announcements#XSA-13_hypercall_physdev_get_free_pirq_vulnerability  View
226139 45087 CVE-2012-3495 [oss-security] 20120905 Xen Security Advisory 13 (CVE-2012-3495) - hypercall physdev_get_free_pirq vulnerability  View
226140 45087 CVE-2012-3495 55406  View
226141 45087 CVE-2012-3495 1027480  View
226142 45087 CVE-2012-3495 http://xenbits.xen.org/hg/xen-4.1-testing.hg/rev/6779ddca8593  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
29800 JVNDB-2012-005507 Xen および Citrix XenServer におけるサービス運用妨害 (DoS) の脆弱性 Xen および Citrix XenServer の arch/x86/physdev.c 内の physdev_get_free_pirq ハイパーコールには、戻り値がエラーを示すか確認せずに、配列インデックスに get_free_pirq 関数の戻り値を使用するため、サービス運用妨害 (不正なメモリ書き込みおよびホストクラッシュ) 状態となる、および権限を取得される脆弱性が存在します。 CVE-2012-3495 56733 CVE-2012-3495 45087 6.1 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-005507.html 2012-09-05 2012-12-07 View