Vulnerability Description
The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service (host crash) by writing to the reserved bits of the DR7 debug control register.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Citrix | Xenserver | <= 6.0.2 |
| Xen | Xen | 4.0.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
- http://lists.xen.org/archives/html/xen-announce/2012-09/msg00000.html
- http://osvdb.org/85197
- http://secunia.com/advisories/50472Vendor Advisory
- http://secunia.com/advisories/50530Vendor Advisory
- http://secunia.com/advisories/51413
- http://secunia.com/advisories/55082
FAQ
What is CVE-2012-3494?
CVE-2012-3494 is a vulnerability with a CVSS score of 2.1 (LOW). The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial...
How severe is CVE-2012-3494?
CVE-2012-3494 has been rated LOW with a CVSS base score of 2.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-3494?
Check the references section above for vendor advisories and patch information. Affected products include: Citrix Xenserver, Xen Xen.