CVE-2012-3432
First published: Mon Dec 03 2012(Updated: )
The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen xen-unstable | =3.3.0 | |
| Xen xen-unstable | =4.0.0 | |
| Xen xen-unstable | =4.0.1 | |
| Xen xen-unstable | =4.0.2 | |
| Xen xen-unstable | =4.0.3 | |
| Xen xen-unstable | =4.0.4 | |
| Xen xen-unstable | =4.1.0 | |
| Xen xen-unstable | =4.1.1 | |
| Xen xen-unstable | =4.1.2 | |
| Xen xen-unstable | =4.1.3 | |
| Xen xen-unstable | =4.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html
- http://lists.xen.org/archives/html/xen-devel/2012-07/msg01649.html
- http://secunia.com/advisories/55082
- http://security.gentoo.org/glsa/glsa-201309-24.xml
- http://www.debian.org/security/2012/dsa-2531
- http://www.securityfocus.com/bid/54691
Frequently Asked Questions
What is the severity of CVE-2012-3432?
CVE-2012-3432 has a medium severity rating as it can lead to denial of service for the guest OS.
How do I fix CVE-2012-3432?
To fix CVE-2012-3432, upgrade your Xen installation to a patched version that addresses this vulnerability.
Which versions of Xen are affected by CVE-2012-3432?
CVE-2012-3432 affects Xen versions 3.3.0 and 4.0.0 to 4.2.0.
What type of attack is possible with CVE-2012-3432?
CVE-2012-3432 allows local guest OS users to cause a denial of service, leading to a crash of the guest OS.
Can CVE-2012-3432 be exploited remotely?
CVE-2012-3432 cannot be exploited remotely as it requires local access to the guest OS.
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/author
- agent/tags
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xen
- canonical/xen xen-unstable
- version/xen xen-unstable/3.3.0
- version/xen xen-unstable/4.0.0
- version/xen xen-unstable/4.0.1
- version/xen xen-unstable/4.0.2
- version/xen xen-unstable/4.0.3
- version/xen xen-unstable/4.0.4
- version/xen xen-unstable/4.1.0
- version/xen xen-unstable/4.1.1
- version/xen xen-unstable/4.1.2
- version/xen xen-unstable/4.1.3
- version/xen xen-unstable/4.2.0