Permissions, Privileges, and Access Controls in Xen - CVE-2012-6033
Published: November 23, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43301
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-6033
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Affected software
Xen
Gentoo Linux
app-emulation/xen
app-emulation/xen-pvgrub
app-emulation/xen-tools
Gentoo Linux
app-emulation/xen
app-emulation/xen-pvgrub
app-emulation/xen-tools
How to mitigate CVE-2012-6033
Install update from vendor's website.
app-emulation/xen - update to 4.2.2-r1
app-emulation/xen-pvgrub - update to 4.2.2-r1
app-emulation/xen-tools - update to 4.2.2-r3
app-emulation/xen-pvgrub - update to 4.2.2-r1
app-emulation/xen-tools - update to 4.2.2-r3
External References
- http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html
- http://osvdb.org/85199
- http://secunia.com/advisories/50472
- http://secunia.com/advisories/55082
- http://security.gentoo.org/glsa/glsa-201309-24.xml
- http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities
- http://www.openwall.com/lists/oss-security/2012/09/05/8
- http://www.securityfocus.com/bid/55410
- http://www.securitytracker.com/id?1027482
- https://exchange.xforce.ibmcloud.com/vulnerabilities/78268
- https://security.gentoo.org/glsa/201604-03