CVE-2012-4544

Xen < 4.2.0 - Denial of Service via PV Domain Builder Kernel or Ramdisk Size Validation

Title source: llm

Description

The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.

References (21)

Core 21

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0241.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/51071

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2012/10/26/3

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091832.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/51413

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091844.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2013/dsa-2636

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/79617

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092050.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/56289

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1027699

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/86619

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/51352

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/51324

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html

Scores

EPSS 0.0009

EPSS Percentile 25.3%

Details

CWE

CWE-20

Status published

Products (5)

xen/xen 4.1.0

xen/xen 4.1.1

xen/xen 4.1.2

xen/xen 4.1.3

xen/xen < 4.2.0

Published Oct 31, 2012

Tracked Since Feb 18, 2026