CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2012-3433
https://notcve.org/view.php?id=CVE-2012-3433
Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service (domain 0 VCPU hang and kernel panic) by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown. Xen v4.0 y v4.1 permite a los kernels OS locales HVM de invitado causar una denegación de servicio (cuelgue de dominio 0 VCPU y "kernel panic") mediante la modificación del espacio de direcciones físicas de una forma que provoca exceso de tiempo de búsqueda de página compartida durante el "p2m teardown". • http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html http://lists.xen.org/archives/html/xen-devel/2012-08/msg00855.html http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://www.debian.org/security/2012/ds • CWE-399: Resource Management Errors •
CVSS: 2.7EPSS: 0%CPEs: 6EXPL: 0CVE-2012-2625 – xen: pv bootloader doesn't check the size of the bzip2 or lzma compressed kernel
https://notcve.org/view.php?id=CVE-2012-2625
The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image. El gestor de arranque Pygrub en Xen inestable ante del changeset 25589:60f09d1ab1fe, v4.2.x, v4.1.x permite causar una denegación de servicio (consumo de memoria) a usuarios locales para-virtualizados a través de una imagen del kernel comprimida en (1) o bzip2 (2) lzma demasiado grande. • http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1817 http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html& • CWE-20: Improper Input Validation •
CVSS: 1.9EPSS: 0%CPEs: 3EXPL: 0CVE-2012-0218
https://notcve.org/view.php?id=CVE-2012-0218
Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag for exception injection when injecting a General Protection Fault, which allows local PV guest OS users to cause a denial of service (guest crash) by later triggering an exception that would normally be handled within Xen. Xen v3.4, v4.0 y v4.1, cuando en el sistema operativo huésped no se ha registrado un controlador para una instrucción syscall o sysenter, no limpia correctamente una bandera para la inyección de excepciones cuando se inyecta un error de protección general (General Protection Fault), lo que permite causar una denegación de servicio (caída del SO invitado) a los usuarios de los sistemas operativos de los PV huéspedes mediante la activación de una excepción que normalmente sería manejado dentro de Xen. • http://lists.xen.org/archives/html/xen-announce/2012-06/msg00003.html http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://www.debian.org/security/2012/dsa-2501 •
CVSS: 4.6EPSS: 0%CPEs: 2EXPL: 0CVE-2012-2934 – kernel: denial of service due to AMD Erratum #121
https://notcve.org/view.php?id=CVE-2012-2934
Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217. Xen v4.0 y v4.1, cuando se ejecuta un cliente PV de 64-bit en CPUs AMD "antiguas", no protege adecuadamente contra un determiando fallo del procesador AMD, lo que permite a usuarios de sistemas operativos huesped provocar una denegación de servicio (caída del host) a través de la ejecución secuencial de las instrucciones. Se trata de una vulnerabilidad diferente a CVE-2012-0217a. • http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html http://lists.xen.org/archives/html/xen-announce/2012-06/msg00002.html http://secunia.com/advisories/51413 http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml http://support.amd.com/us/Processor_TechDocs/25759.pdf http://www.debian.org/security/2012/dsa-2501 http://www.securityfocus.com/bid/53961 •
CVSS: 7.9EPSS: 0%CPEs: 20EXPL: 4CVE-2012-0217 – FreeBSD Intel SYSRET Privilege Escalation
https://notcve.org/view.php?id=CVE-2012-0217
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier. El modo de usuario Scheduler en el núcleo en Microsoft Windows Server v2008 R2 y R2 SP1 y Windows v7 Gold y SP1 sobre la plataforma x64 no maneja adecuadamente solicitudes del sistema, lo que permite a usuarios locales obtener privilegios a través de una aplicación modificada, también conocida como "vulnerabilidad de corrupción de memoria de modo de usuario Scheduler". It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level. • https://www.exploit-db.com/exploits/46508 https://www.exploit-db.com/exploits/28718 https://www.exploit-db.com/exploits/20861 http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html http://lists.xen.org/archives/html/xen-devel/2012-06 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •