cvelistv5 - cve-2012-3495

CVE-2012-3495 (GCVE-0-2012-3495)

Vulnerability from cvelistv5

Published

2012-11-23 20:00

Modified

2024-08-06 20:05

Severity ?

CWE

Summary

The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.

References

URL

Tags

	http://secunia.com/advisories/55082	third-party-advisory, x_refsource_SECUNIA
	http://xenbits.xen.org/hg/xen-4.1-testing.hg/rev/6779ddca8593	x_refsource_CONFIRM
	http://lists.xen.org/archives/html/xen-announce/2012-09/msg00001.html	mailing-list, x_refsource_MLIST
	http://secunia.com/advisories/51413	third-party-advisory, x_refsource_SECUNIA
	http://security.gentoo.org/glsa/glsa-201309-24.xml	vendor-advisory, x_refsource_GENTOO
	http://wiki.xen.org/wiki/Security_Announcements#XSA-13_hypercall_physdev_get_free_pirq_vulnerability	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html	vendor-advisory, x_refsource_SUSE
	http://www.securityfocus.com/bid/55406	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id?1027480	vdb-entry, x_refsource_SECTRACK
	https://security.gentoo.org/glsa/201604-03	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html	vendor-advisory, x_refsource_SUSE
	http://support.citrix.com/article/CTX134708	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2012/09/05/6	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:12.705Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "55082",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/55082"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/hg/xen-4.1-testing.hg/rev/6779ddca8593"
          },
          {
            "name": "[Xen-announce] 20120905 Xen Security Advisory 13 (CVE-2012-3495) - hypercall physdev_get_free_pirq vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00001.html"
          },
          {
            "name": "51413",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/51413"
          },
          {
            "name": "GLSA-201309-24",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.xen.org/wiki/Security_Announcements#XSA-13_hypercall_physdev_get_free_pirq_vulnerability"
          },
          {
            "name": "openSUSE-SU-2012:1572",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html"
          },
          {
            "name": "55406",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/55406"
          },
          {
            "name": "1027480",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1027480"
          },
          {
            "name": "GLSA-201604-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201604-03"
          },
          {
            "name": "SUSE-SU-2012:1132",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.citrix.com/article/CTX134708"
          },
          {
            "name": "[oss-security] 20120905 Xen Security Advisory 13 (CVE-2012-3495) - hypercall physdev_get_free_pirq vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/09/05/6"
          },
          {
            "name": "SUSE-SU-2012:1133",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html"
          },
          {
            "name": "openSUSE-SU-2012:1573",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html"
          },
          {
            "name": "openSUSE-SU-2012:1172",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-09-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-30T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "55082",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/55082"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://xenbits.xen.org/hg/xen-4.1-testing.hg/rev/6779ddca8593"
        },
        {
          "name": "[Xen-announce] 20120905 Xen Security Advisory 13 (CVE-2012-3495) - hypercall physdev_get_free_pirq vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00001.html"
        },
        {
          "name": "51413",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/51413"
        },
        {
          "name": "GLSA-201309-24",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.xen.org/wiki/Security_Announcements#XSA-13_hypercall_physdev_get_free_pirq_vulnerability"
        },
        {
          "name": "openSUSE-SU-2012:1572",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html"
        },
        {
          "name": "55406",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/55406"
        },
        {
          "name": "1027480",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1027480"
        },
        {
          "name": "GLSA-201604-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201604-03"
        },
        {
          "name": "SUSE-SU-2012:1132",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.citrix.com/article/CTX134708"
        },
        {
          "name": "[oss-security] 20120905 Xen Security Advisory 13 (CVE-2012-3495) - hypercall physdev_get_free_pirq vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/09/05/6"
        },
        {
          "name": "SUSE-SU-2012:1133",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html"
        },
        {
          "name": "openSUSE-SU-2012:1573",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html"
        },
        {
          "name": "openSUSE-SU-2012:1172",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-3495",
    "datePublished": "2012-11-23T20:00:00.000Z",
    "dateReserved": "2012-06-14T00:00:00.000Z",
    "dateUpdated": "2024-08-06T20:05:12.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2012-AVI-544

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans Citrix NetScaler SDX. Elles permettent de faire des dénis de service et des élévations de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Citrix	NetScaler SDX	Citrix NetScaler SDX versions 10.0.x
	Citrix	NetScaler SDX	Citrix NetScaler SDX versions 9.3.x

References

Title

Publication Time

Tags

Bulletin de sécurité Citrix CTX134876 du 01 octobre 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Citrix NetScaler SDX versions 10.0.x",
      "product": {
        "name": "NetScaler SDX",
        "vendor": {
          "name": "Citrix",
          "scada": false
        }
      }
    },
    {
      "description": "Citrix NetScaler SDX versions 9.3.x",
      "product": {
        "name": "NetScaler SDX",
        "vendor": {
          "name": "Citrix",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-3433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3433"
    },
    {
      "name": "CVE-2012-3432",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3432"
    },
    {
      "name": "CVE-2012-3516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3516"
    },
    {
      "name": "CVE-2012-3496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3496"
    },
    {
      "name": "CVE-2012-3495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3495"
    },
    {
      "name": "CVE-2012-3494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3494"
    },
    {
      "name": "CVE-2012-3515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3515"
    },
    {
      "name": "CVE-2012-3498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3498"
    },
    {
      "name": "CVE-2012-4606",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-4606"
    }
  ],
  "initial_release_date": "2012-10-03T00:00:00",
  "last_revision_date": "2012-10-03T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-544",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-10-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eCitrix NetScaler SDX\u003c/span\u003e. Elles permettent de faire\ndes d\u00e9nis de service et des \u00e9l\u00e9vations de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Citrix NetScaler SDX",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Citrix CTX134876 du 01 octobre 2012",
      "url": "https://support.citrix.com/article/CTX134876"
    }
  ]
}

CERTA-2012-AVI-485

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans Xen. Elles concernent des dénis de service et des élévations de privilèges, y compris des systèmes invités vers l'hôte.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Toutes les versions de Xen 4 (4.0, 4.1, 4.2, Xen-unstable) sont affectées par au moins une des vulnérabilités.

Se référer aux bulletins de sécurité de l'éditeur pour le détail exact des configurations impactées.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletins de sécurité Xen 12 à 18	None	vendor-advisory
Xen Security Advisory 13 :	-	other
Xen Security Advisory 17 :	-	other
Xen Security Advisory 15 :	-	other
Xen Security Advisory 18 :	-	other
Xen Security Advisory 14 :	-	other
Xen Security Advisory 16 :	-	other
Xen Security Advisory 12 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eToutes les versions de Xen 4 (4.0, 4.1,  4.2, Xen-unstable) sont affect\u00e9es par au moins une des  vuln\u00e9rabilit\u00e9s.  \u003cP\u003eSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour le  d\u00e9tail exact des configurations impact\u00e9es.\u003c/P\u003e\u003c/p\u003e",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2012-3497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3497"
    },
    {
      "name": "CVE-2012-3516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3516"
    },
    {
      "name": "CVE-2012-3496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3496"
    },
    {
      "name": "CVE-2012-3495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3495"
    },
    {
      "name": "CVE-2012-3494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3494"
    },
    {
      "name": "CVE-2012-3515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3515"
    },
    {
      "name": "CVE-2012-3498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-3498"
    }
  ],
  "initial_release_date": "2012-09-06T00:00:00",
  "last_revision_date": "2012-09-06T00:00:00",
  "links": [
    {
      "title": "Xen Security Advisory 13 :",
      "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00001.html"
    },
    {
      "title": "Xen Security Advisory 17 :",
      "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00003.html"
    },
    {
      "title": "Xen Security Advisory 15 :",
      "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html"
    },
    {
      "title": "Xen Security Advisory 18 :",
      "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00004.html"
    },
    {
      "title": "Xen Security Advisory 14 :",
      "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00002.html"
    },
    {
      "title": "Xen Security Advisory 16 :",
      "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00005.html"
    },
    {
      "title": "Xen Security Advisory 12 :",
      "url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00000.html"
    }
  ],
  "reference": "CERTA-2012-AVI-485",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-09-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans Xen. Elles concernent\ndes d\u00e9nis de service et des \u00e9l\u00e9vations de privil\u00e8ges, y compris des\nsyst\u00e8mes invit\u00e9s vers l\u0027h\u00f4te.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Xen",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 Xen 12 \u00e0 18",
      "url": null
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2012-3495 (GCVE-0-2012-3495)

Vulnerability from cvelistv5

CERTA-2012-AVI-544

Vulnerability from certfr_avis

Solution

CERTA-2012-AVI-485

Vulnerability from certfr_avis

Solution

Tags

Sightings

Nomenclature