CVE-2012-6033

The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.

CVSS v2.0 4.4 MEDIUM

4.4^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/85199
http://www.openwall.com/lists/oss-security/2012/09/05/8
http://secunia.com/advisories/50472	Vendor Advisory
http://www.securityfocus.com/bid/55410
http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities
http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html	Vendor Advisory
http://www.securitytracker.com/id?1027482
http://secunia.com/advisories/55082
http://security.gentoo.org/glsa/glsa-201309-24.xml
https://security.gentoo.org/glsa/201604-03
https://exchange.xforce.ibmcloud.com/vulnerabilities/78268

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:xen:xen:4.1.0:::::::*
	cpe:2.3:o:xen:xen:4.2.0:::::::*
	cpe:2.3:o:xen:xen:4.0.0:::::::*

Information

Published : 2012-11-23 12:55

Updated : 2017-08-28 18:32

NVD link : CVE-2012-6033

Mitre link : CVE-2012-6033

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

xen

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://osvdb.org/85199", "name": "85199", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.openwall.com/lists/oss-security/2012/09/05/8", "name": "[oss-security] 20120905 Xen Security Advisory 15 (CVE-2012-3497) - multiple TMEM hypercall vulnerabilities", "tags": [], "refsource": "MLIST"}, {"url": "http://secunia.com/advisories/50472", "name": "50472", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/55410", "name": "55410", "tags": [], "refsource": "BID"}, {"url": "http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities", "name": "http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities", "tags": [], "refsource": "CONFIRM"}, {"url": "http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html", "name": "[Xen-announce] 20120905 Xen Security Advisory 15 (CVE-2012-3497) - multiple TMEM hypercall vulnerabilities", "tags": ["Vendor Advisory"], "refsource": "MLIST"}, {"url": "http://www.securitytracker.com/id?1027482", "name": "1027482", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/55082", "name": "55082", "tags": [], "refsource": "SECUNIA"}, {"url": "http://security.gentoo.org/glsa/glsa-201309-24.xml", "name": "GLSA-201309-24", "tags": [], "refsource": "GENTOO"}, {"url": "https://security.gentoo.org/glsa/201604-03", "name": "GLSA-201604-03", "tags": [], "refsource": "GENTOO"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78268", "name": "xen-tmem-priv-esc(78268)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2012-6033", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2012-11-23T20:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-29T01:32Z"}

4.4 /10