CVE-2012-4537
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p...
2.1 LowFix available
CVE-2012-4537 is a low vulnerability (CVSS 2.1) in Xen, published November 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in xen 4.1.3-4.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.44%EPSS, 38th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.1.3-4xen +37 more
Description
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
Exploit likelihood
0.44%Down 1.1 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenDebian:12 | before 4.1.3-4 | 4.1.3-4 |
xenDebian:13 | before 4.1.3-4 | 4.1.3-4 |
xenDebian:14 | before 4.1.3-4 | 4.1.3-4 |
xenDebian:6.0 From an advisory covering 9 CVEs | before 4.0.1-5.5, plus listed versions 4.0.1-24.0.1-44.0.1-54.0.1-5.14.0.1-5.24.0.1-5.34.0.1-5.4 | 4.0.1-5.5 |
kernelRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-PAERed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-PAE-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-PAE-develRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debugRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debug-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-debug-develRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debuginfo-commonRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-develRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-docRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-headersRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-xenRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-xen-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-xen-develRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernelRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-PAERed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-PAE-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-PAE-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debugRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debug-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debug-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-debuginfo-commonRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-docRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-headersRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-kdumpRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-kdump-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-kdump-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-xenRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-xen-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
kernel-xen-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:2.6.18-308.24.1.el5 | 0:2.6.18-308.24.1.el5 |
xenopenSUSE:Tumbleweed From an advisory covering 124 CVEs | before 4.7.0_12-1.3 | 4.7.0_12-1.3 |
What each source reports
NVD Score used
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
- Record
CVE-2012-4537- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-16
- Updated
- 2026-11-02
CVE ListNo score
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
- Record
CVE-2012-4537- Updated
- 2026-11-02
EUVDEUVD-2012-4465No score
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
- Record
EUVD-2012-4465- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m3g8-h8w3-8hqmNo score
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p...
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
- Record
GHSA-m3g8-h8w3-8hqm- Updated
- 2026-11-02
OSVNo score
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
- Record
CVE-2012-4537- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4537No score
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
- Record
DEBIAN-CVE-2012-4537- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10196-1No score
xen-4.7.0_12-1.3 on GA media
These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10196-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2012-1540.html
lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
secunia.com/advisories/55082
exchange.xforce.ibmcloud.com/vulnerabilities/80024
openwall.com/lists/oss-security/2012/11/13/6
Show 171 moreShow less
security.gentoo.org/glsa/glsa-201309-24.xml
debian.org/security/2012/dsa-2582
lists.xen.org/archives/html/xen-announce/2012-11/msg00005.html
securityfocus.com/bid/56498
osvdb.org/87307
securitytracker.com/id?1027761
nvd.nist.gov/vuln/detail/CVE-2012-4537
github.com/advisories/GHSA-m3g8-h8w3-8hqm
security-tracker.debian.org/tracker/CVE-2012-4537
access.redhat.com/errata/RHSA-2012:1540
bugzilla.redhat.com/show_bug.cgi?id=822754
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1540.json
cve.org/CVERecord?id=CVE-2012-2372
suse.com/security/cve/CVE-2011-1898