CVE-2013-2072

Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and...

7.4 HighPublic exploitFix available

Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.

Exploit likelihood

1.06%Down 2.0 points since Feb 4, 2022

What each source reports

NVD Score used 7.4

Record: CVE-2013-2072
CVSS 2.0: 7.4 HighAV:A/AC:M/Au:S/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-2072
Updated: 2026-11-02

EUVDEUVD-2013-2051 No score

Record: EUVD-2013-2051
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fqgm-98vq-7hgr No score

Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and...

Record: GHSA-fqgm-98vq-7hgr
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Record: CVE-2013-2072
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-2072 No score

Record: DEBIAN-CVE-2013-2072
Updated: 2026-11-02

OSVMGASA-2013-0197 No score

Updated xen package fixes security issues

This update fixes the following security issues: XSA-52/CVE-2013-2076: Information leak on XSAVE/XRSTOR capable AMD CPUs XSA-53/CVE-2013-2077: Hypervisor crash due to missing exception recovery on XRSTOR XSA-54/CVE-2013-2078: Hypervisor crash due to missing exception recovery on XSETBV XSA-55/CVE-2013-2194: integer overflows XSA-55/CVE-2013-2195: pointer dereferences XSA-55/CVE-2013-2196: other problems XSA-56/CVE-2013-2072: Buffer overflow in xencontrol Python bindings affecting xend XSA-57/CVE-2013-2211: libxl allows guest write access to sensitive console related xenstore keys XSA-58/CVE-2013-1432: Page reference counting error due to XSA-45/CVE-2013-1918 fixes

Record: MGASA-2013-0197
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`xen` Debian:12	before 4.2.2-1	4.2.2-1
`xen` Debian:13	before 4.2.2-1	4.2.2-1
`xen` Debian:14	before 4.2.2-1	4.2.2-1
`xen` Debian:7 From an advisory covering 5 CVEs	before 4.1.4-3+deb7u3, plus listed versions 4.1.4-34.1.4-3+deb7u14.1.4-3+deb7u2	4.1.4-3+deb7u3
`xen` Mageia:3 From an advisory covering 9 CVEs	before 4.2.1-16.2.mga3	4.2.1-16.2.mga3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	bl4ck5un/cve-2013-2072	2014-04-07

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2072 is a high vulnerability (CVSS 7.4) in Xen, published July 1, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in xen 4.2.2-1.

References

Show 6 moreShow less