CVE-2012-5525 - The get_page_from_gfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause

CVE-2012-5525

Summary

The get_page_from_gfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service (crash) via a crafted GFN that triggers a buffer over-read.

References

http://secunia.com/advisories/51397
http://secunia.com/advisories/55082
http://security.gentoo.org/glsa/glsa-201309-24.xml
http://www.openwall.com/lists/oss-security/2012/12/03/6
http://www.osvdb.org/88133
http://www.securityfocus.com/bid/56805
https://exchange.xforce.ibmcloud.com/vulnerabilities/80480

Vulnerable Configurations

cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*

CVSS

Base:	4.7 (as of 29-08-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	COMPLETE

cvss-vector via4

AV:L/AC:M/Au:N/C:N/I:N/A:C

refmap via4

bid	56805
gentoo	GLSA-201309-24
mlist	[oss-security] 20121203 Xen Security Advisory 26 (CVE-2012-5510) - Grant table version switch list corruption vulnerability
osvdb	88133
secunia	51397 55082
xf	xen-getpagefromgfn-dos(80480)

Last major update

29-08-2017 - 01:32

Published

13-12-2012 - 11:53

Last modified

29-08-2017 - 01:32