CVE-2012-4544: Input Validation
First published: Wed Oct 31 2012(Updated: )
The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen xen-unstable | <=4.2.0 | |
| Xen xen-unstable | =4.1.0 | |
| Xen xen-unstable | =4.1.1 | |
| Xen xen-unstable | =4.1.2 | |
| Xen xen-unstable | =4.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091832.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091844.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092050.html
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
- http://osvdb.org/86619
- http://rhn.redhat.com/errata/RHSA-2013-0241.html
- http://secunia.com/advisories/51071
- http://secunia.com/advisories/51324
- http://secunia.com/advisories/51352
- http://secunia.com/advisories/51413
- http://www.debian.org/security/2013/dsa-2636
- http://www.openwall.com/lists/oss-security/2012/10/26/3
- http://www.securityfocus.com/bid/56289
- http://www.securitytracker.com/id?1027699
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79617
Frequently Asked Questions
What is the severity of CVE-2012-4544?
CVE-2012-4544 is classified as a denial of service vulnerability due to excessive memory consumption in domain 0.
How do I fix CVE-2012-4544?
To fix CVE-2012-4544, upgrade to Xen version 4.2.1 or later, which contains the necessary patches.
What are the affected versions in CVE-2012-4544?
CVE-2012-4544 affects Xen 4.2 and earlier versions, specifically 4.1.x versions including 4.1.0 to 4.1.3.
What type of attack does CVE-2012-4544 allow?
CVE-2012-4544 allows local guest administrators to perform denial of service attacks through crafted kernels or ramdisks.
Can CVE-2012-4544 impact my Xen environment?
Yes, CVE-2012-4544 can significantly impact your Xen environment by causing domain 0 to consume excessive memory.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xen
- canonical/xen xen-unstable
- version/xen xen-unstable/4.2.0
- version/xen xen-unstable/4.1.0
- version/xen xen-unstable/4.1.1
- version/xen xen-unstable/4.1.2
- version/xen xen-unstable/4.1.3