CVE-2012-6035: Input Validation
The dotmemdestroypool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6035?
CVE-2012-6035 has a high severity rating due to its potential to cause denial of service and arbitrary code execution.
How do I fix CVE-2012-6035?
To fix CVE-2012-6035, upgrade to a patched version of Xen that addresses this vulnerability.
What systems are affected by CVE-2012-6035?
CVE-2012-6035 affects Xen versions 4.0.0, 4.1.0, and 4.2.0.
What kind of attack does CVE-2012-6035 facilitate?
CVE-2012-6035 allows local guest OS users to perform denial of service attacks or execute arbitrary code.
Is CVE-2012-6035 a remote or local vulnerability?
CVE-2012-6035 is a local vulnerability, only exploitable by users with access to the guest OS.