CVE-2013-2072
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and...
CVE-2013-2072 is a high vulnerability (CVSS 7.4) in Xen, published July 1, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 65th percentile. Fixed in xen 4.2.2-1.
- Severity
- 7.4 HighCVSS 2.0, NVD
- Exploit chance
- 1.06%EPSS, 65th percentile
- Exploitation
- None known1 public exploit
- Fixed in
4.2.2-1xen +4 more
Description
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenDebian:12 | before 4.2.2-1 | 4.2.2-1 |
xenDebian:13 | before 4.2.2-1 | 4.2.2-1 |
xenDebian:14 | before 4.2.2-1 | 4.2.2-1 |
xenDebian:7 From an advisory covering 5 CVEs | before 4.1.4-3+deb7u3, plus listed versions 4.1.4-34.1.4-3+deb7u14.1.4-3+deb7u2 | 4.1.4-3+deb7u3 |
xenMageia:3 From an advisory covering 9 CVEs | before 4.2.1-16.2.mga3 | 4.2.1-16.2.mga3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | bl4ck5un/cve-2013-2072 | 2014-04-07 |
What each source reports
NVD Score used
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
- Record
CVE-2013-2072- CVSS 2.0
- 7.4 High
AV:A/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
- Record
CVE-2013-2072- Updated
- 2026-11-02
EUVDEUVD-2013-2051No score
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
- Record
EUVD-2013-2051- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fqgm-98vq-7hgrNo score
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and...
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
- Record
GHSA-fqgm-98vq-7hgr- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
- Record
CVE-2013-2072- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2072No score
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
- Record
DEBIAN-CVE-2013-2072- Updated
- 2026-11-02
OSVMGASA-2013-0197No score
Updated xen package fixes security issues
This update fixes the following security issues: XSA-52/CVE-2013-2076: Information leak on XSAVE/XRSTOR capable AMD CPUs XSA-53/CVE-2013-2077: Hypervisor crash due to missing exception recovery on XRSTOR XSA-54/CVE-2013-2078: Hypervisor crash due to missing exception recovery on XSETBV XSA-55/CVE-2013-2194: integer overflows XSA-55/CVE-2013-2195: pointer dereferences XSA-55/CVE-2013-2196: other problems XSA-56/CVE-2013-2072: Buffer overflow in xencontrol Python bindings affecting xend XSA-57/CVE-2013-2211: libxl allows guest write access to sensitive console related xenstore keys XSA-58/CVE-2013-1432: Page reference counting error due to XSA-45/CVE-2013-1918 fixes
- Record
MGASA-2013-0197- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/59982
lists.fedoraproject.org/pipermail/package-announce/2013-May/106721.html
openwall.com/lists/oss-security/2013/05/17/2
lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
debian.org/security/2014/dsa-3041