CVE-2012-3495
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2...
CVE-2012-3495 is a medium vulnerability (CVSS 6.1) in Citrix Xenserver, published November 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in xen 4.1.3-2.
- Severity
- 6.1 MediumCVSS 2.0, NVD
- Exploit chance
- 0.44%EPSS, 38th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.1.3-2xen +2 more
Description
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
- Record
CVE-2012-3495- CVSS 2.0
- 6.1 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
- Record
CVE-2012-3495- Updated
- 2026-11-02
EUVDEUVD-2012-3451No score
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
- Record
EUVD-2012-3451- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w2q9-w27j-m384No score
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2...
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
- Record
GHSA-w2q9-w27j-m384- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVNo score
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
- Record
CVE-2012-3495- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3495No score
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
- Record
DEBIAN-CVE-2012-3495- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/55082
xenbits.xen.org/hg/xen-4.1-testing.hg/rev/6779ddca8593
lists.xen.org/archives/html/xen-announce/2012-09/msg00001.html
security.gentoo.org/glsa/glsa-201309-24.xml
wiki.xen.org/wiki/Security_Announcements
Show 13 moreShow less
lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
securityfocus.com/bid/55406
securitytracker.com/id?1027480
support.citrix.com/article/CTX134708
openwall.com/lists/oss-security/2012/09/05/6
nvd.nist.gov/vuln/detail/CVE-2012-3495
github.com/advisories/GHSA-w2q9-w27j-m384
security-tracker.debian.org/tracker/CVE-2012-3495