{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-07-27T00:00:00", "descriptions": [{"lang": "en", "value": "The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2013-01-29T10:00:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "DSA-2531", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2012/dsa-2531"}, {"name": "55082", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/55082"}, {"name": "[Xen-devel] 20120727 Xen Security Advisory 10 (CVE-2012-3432) - HVM user\tmode MMIO emul DoS", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.xen.org/archives/html/xen-devel/2012-07/msg01649.html"}, {"name": "GLSA-201309-24", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"}, {"name": "SUSE-SU-2012:1044", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html"}, {"name": "SUSE-SU-2012:1043", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html"}, {"name": "openSUSE-SU-2012:1174", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html"}, {"name": "54691", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/54691"}, {"name": "openSUSE-SU-2012:1172", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T20:05:12.514Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-2531", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2012/dsa-2531"}, {"name": "55082", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/55082"}, {"name": "[Xen-devel] 20120727 Xen Security Advisory 10 (CVE-2012-3432) - HVM user\tmode MMIO emul DoS", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.xen.org/archives/html/xen-devel/2012-07/msg01649.html"}, {"name": "GLSA-201309-24", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"}, {"name": "SUSE-SU-2012:1044", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html"}, {"name": "SUSE-SU-2012:1043", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html"}, {"name": "openSUSE-SU-2012:1174", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html"}, {"name": "54691", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/54691"}, {"name": "openSUSE-SU-2012:1172", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-3432", "datePublished": "2012-12-03T21:00:00", "dateReserved": "2012-06-14T00:00:00", "dateUpdated": "2024-08-06T20:05:12.514Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:3.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "EB157D09-B91B-486A-A9F7-C9BA75AE8823", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "550223A9-B9F1-440A-8C25-9F0F76AF7301", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "FC734D58-96E5-4DD2-8781-F8E0ADB96462", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "62CEC1BF-1922-410D-BCBA-C58199F574C7", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "923F2C2B-4A65-4823-B511-D0FEB7C7FAB2", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "C1A24DED-B2EC-4D9C-9FA4-DD37EF3E3BFC", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "0D532B60-C8DD-4A2F-9D05-E574D23EB754", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "5D83CA8B-8E49-45FA-8FAB-C15052474542", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "27537DF5-7E0F-463F-BA87-46E329EE07AC", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "3EA4F978-9145-4FE6-B4F9-15207E52C40A", "vulnerable": true}, {"criteria": "cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "8F0AF8EF-6FF6-4E22-B16E-82C9F90C6B00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions."}, {"lang": "es", "value": "La funci\u00f3n handle_mmio en arch/x86/hvm/io.c en el emulador de operaciones MMIO para Xen v3.3 y v4.x, cuando se ejecuta un HVM huesped, no reinicia correctamente la informaci\u00f3n de estado entre determinados ciclos de emulaci\u00f3n, lo que permite a los usuarios del sistema operativo hu\u00e9sped provocar una denegaci\u00f3n de servicio (ca\u00edda de OS huesped) a trav\u00e9s de operaciones no especificadas en las regiones MMIO."}], "id": "CVE-2012-3432", "lastModified": "2024-11-21T01:40:51.977", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 1.9, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-12-03T21:55:01.657", "references": [{"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Vendor Advisory"], "url": "http://lists.xen.org/archives/html/xen-devel/2012-07/msg01649.html"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/55082"}, {"source": "secalert@redhat.com", "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"}, {"source": "secalert@redhat.com", "url": "http://www.debian.org/security/2012/dsa-2531"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/54691"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00024.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00025.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://lists.xen.org/archives/html/xen-devel/2012-07/msg01649.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/55082"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2012/dsa-2531"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/54691"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Xen for reporting this issue.", "bugzilla": {"description": "kernel: xen: HVM guest user mode MMIO emulation DoS", "id": "843570", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=843570"}, "csaw": false, "cvss": {"cvss_base_score": "4.4", "cvss_scoring_vector": "AV:L/AC:M/Au:S/C:N/I:N/A:C", "status": "draft"}, "details": ["The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions."], "name": "CVE-2012-3432", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "kernel-xen", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/a:redhat:enterprise_mrg:2", "fix_state": "Not affected", "package_name": "realtime-kernel", "product_name": "Red Hat Enterprise MRG 2"}], "public_date": "2012-07-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-3432\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-3432"], "statement": "Not vulnerable.\nThe versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6,\nand Red Hat Enterprise MRG are not affected. \nThe versions of the kernel-xen packages as shipped with Red Hat Enterprise Linux 5 are not affected as they implement a different MMIO emulation mechanism.", "threat_severity": "Moderate"}