CVE-2012-3494

LOW 2.1CVE-2012-3494 · Published 23/11/2012 · updated 16/06/2026

In short

CVE-2012-3494 is a LOW (CVSS 2.1) vulnerability affecting xenserver (citrix).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
xenserver citrix	`≤ 6.0.2`	No fix yet

Description

The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service (host crash) by writing to the reserved bits of the DR7 debug control register.

References

lists.opensuse.org/opensuse-security-announce/2012-09/msg00001.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00005.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00012.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00018.html
lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
lists.xen.org/archives/html/xen-announce/2012-09/msg00000.html
osvdb.org/85197

More vulnerabilities in xenserver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free