CVSS: 7.4EPSS: 0%CPEs: 27EXPL: 0CVE-2012-5513 – kernel: xen: XENMEM_exchange may overwrite hypervisor memory
https://notcve.org/view.php?id=CVE-2012-5513
The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range. El manejador XENMEM_exchange en Xen v4.2 y anteriores no comprueba correctamente la dirección de memoria, lo que permite causar una denegación de servicio (caída del S.O.) a administrador de sistemas operativos invitados PV o posiblemente obtener privilegios a través de vectores no especificados que sobrescriben memoria en rangos del hipervisor reservados. • http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2014-04 • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2012-4538
https://notcve.org/view.php?id=CVE-2012-4538
The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors. La llamada HVMOP_pagetable_dying en Xen v4.0, v4.1, y v4.2 no comprueba correctamente el estado "pagetable" cuando se ejecuta en "shadow pagetables", lo que permite a un sistema operativo HVM de invitado causar una denegación de servicio (caída del hipervisor) a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html http://lists.xen.org/archives/html/xen-announce/2012-11&#x • CWE-20: Improper Input Validation •
CVSS: 4.7EPSS: 0%CPEs: 3EXPL: 0CVE-2012-6031
https://notcve.org/view.php?id=CVE-2012-6031
The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others. La función do_tmem_get en el Transcendent Memory (TMEM) en Xen v4.0, v4.1, y v4.2 permiten a los usuarios del SO invitado provocar una denegación de servicio (caída del host) a través de vectores relacionados con un "spinlock" siendo mantenido en el "bad_copy error path." NOTA: este problema se publicó originalmente como parte del CVE-2012-3497, que era demasiado general; CVE-2012-3497 se ha dividido en este ID y otros. • http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html http://osvdb.org/85199 http://secunia.com/advisories/50472 http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities http://www.openwall.com/lists/oss-security/2012/09/05/8 http://www.securityfocus.com/bid/55410 http://www.securitytracker.com/id?1027482 https://exchange.xforce.ibmcloud& • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2012-6030
https://notcve.org/view.php?id=CVE-2012-6030
The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others. La función do_tmem_op en el Transcendent Memory (TMEM) en Xen v4.0, v4.1, y v4.2 permiten a los usuarios del SO invitado provocar una denegación de servicio (caída del host) y posiblemente generar otros impactos no especificados mediante vectores no especificados relacionados con "broken locking checks" en un "error path." NOTA: este problema se publicó originalmente como parte del CVE-2012-3497, que era demasiado general; CVE-2012-3497 se ha dividido en este ID y otros. • http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html http://osvdb.org/85199 http://secunia.com/advisories/50472 http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities http://www.openwall.com/lists/oss-security/2012/09/05/8 http://www.securityfocus.com/bid/55410 http://www.securitytracker.com/id?1027482 https://exchange.xforce.ibmcloud& • CWE-20: Improper Input Validation •
CVSS: 4.4EPSS: 0%CPEs: 3EXPL: 0CVE-2012-6034
https://notcve.org/view.php?id=CVE-2012-6034
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others. La función (1) tmemc_save_get_next_page y (2) tmemc_save_get_next_inv y la sub-operación (3) TMEMC_SAVE_GET_POOL_UUID sub-operación en el Transcendent Memory (TMEM) en Xen v4.0, v4.1, y v4.2 no chequea los punteros entrantes del búfer de salida de invitado, lo que permite a usuarios del SO de invitado provocar una denegación de servicio (corrupción de memoria y caída del host) o posiblemente ejecutar código arbitrario a través de vectores no especificados. NOTA: este problema se publicó originalmente como parte de CVE-2012-3497, que era demasiado general; CVE-2012-3497 se ha dividido en este ID y otros. • http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html http://osvdb.org/85199 http://secunia.com/advisories/50472 http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities http://www.openwall.com/lists/oss-security/2012/09/05/8 http://www.securityfocus.com/bid/55410 http://www.securitytracker.com/id?1027482 https://exchange.xforce.ibmcloud& • CWE-20: Improper Input Validation •