Citrix XenServer 5.0/5.5/5.6/6.0/6.0.2 PHYSDEVOP_get_free_pirq input validation
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.9 | $0-$5k | 0.00 |
Summary
A vulnerability was found in Citrix XenServer 5.0/5.5/5.6/6.0/6.0.2. It has been classified as problematic. This affects the function PHYSDEVOP_get_free_pirq. The manipulation leads to input validation.
This vulnerability is uniquely identified as CVE-2012-3495. There is no exploit available.
It is recommended to apply a patch to fix this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Details
A vulnerability was found in Citrix XenServer 5.0/5.5/5.6/6.0/6.0.2 (Virtualization Software) and classified as problematic. Affected by this issue is the function PHYSDEVOP_get_free_pirq. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly. Impacted is availability. CVE summarizes:
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
The weakness was released 09/05/2012 by Matthew Daley as 2012-09/msg00001 as confirmed posting (Maillist). The advisory is shared for download at lists.xen.org. The public release was coordinated with the vendor. This vulnerability is handled as CVE-2012-3495 since 06/14/2012. The attack needs to be approached locally. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.
The vulnerability scanner Nessus provides a plugin with the ID 62155 (Fedora 16 : xen-4.1.3-2.fc16 (2012-13443)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks. The commercial vulnerability scanner Qualys is able to test this issue with plugin 370049 (Citrix XenServer Security Update (CTX134708)).
Applying the patch xsa13 is able to eliminate this problem. The bugfix is ready for download at lists.xen.org. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (78266), Tenable (62155), SecurityFocus (BID 55406†), OSVDB (85202†) and Secunia (SA50472†). Entries connected to this vulnerability are available at VDB-5876, VDB-5927, VDB-6105 and VDB-6107. If you want to get best quality of vulnerability data, you may have to visit VulDB.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.2VulDB Meta Temp Score: 5.9
VulDB Base Score: 6.2
VulDB Temp Score: 5.9
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Input validationCWE: CWE-20
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | unlock | unlock | unlock | unlock |
|---|---|---|---|---|
| Today | unlock | unlock | unlock | unlock |
Nessus ID: 62155
Nessus Name: Fedora 16 : xen-4.1.3-2.fc16 (2012-13443)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
OpenVAS ID: 864722
OpenVAS Name: Fedora Update for xen FEDORA-2012-13434
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Patch: xsa13
Timeline
06/14/2012 🔍09/05/2012 🔍
09/05/2012 🔍
09/05/2012 🔍
09/05/2012 🔍
09/05/2012 🔍
09/10/2012 🔍
11/15/2012 🔍
11/23/2012 🔍
04/12/2021 🔍
Sources
Vendor: citrix.comAdvisory: 2012-09/msg00001
Researcher: Matthew Daley
Status: Confirmed
Confirmation: 🔍
Coordinated: 🔍
CVE: CVE-2012-3495 (🔍)
GCVE (CVE): GCVE-0-2012-3495
GCVE (VulDB): GCVE-100-6116
X-Force: 78266
SecurityFocus: 55406 - Xen 'physdev_get_free_pirq' CVE-2012-3495 Denial of Service Vulnerability
Secunia: 50472 - Xen Multiple Denial of Service and Privilege Escalation Vulnerabilities, Less Critical
OSVDB: 85202
SecurityTracker: 1027480 - Xen physdev_get_free_pirq() Error Checking Bug Lets Local Guest Users Deny Service on the Host
Vulnerability Center: 37247 - Citrix XenServer, Citrix NetScaler SDX and XenSource Xen Local Denial of Service - CVE-2012-3495, Medium
See also: 🔍
Entry
Created: 09/10/2012 14:22Updated: 04/12/2021 08:34
Changes: 09/10/2012 14:22 (84), 04/21/2017 11:33 (4), 04/12/2021 08:34 (2)
Complete: 🔍
Committer: olku
Cache ID: 216:4D4:103
No comments yet. Languages: en.
Please log in to comment.