The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
| Link | Tags |
|---|---|
| http://secunia.com/advisories/55082 | third party advisory |
| http://www.securitytracker.com/id?1027482 | vdb entry |
| http://wiki.xen.org/wiki/Security_Announcements#XSA-15_multiple_TMEM_hypercall_vulnerabilities | vendor advisory |
| http://security.gentoo.org/glsa/glsa-201309-24.xml | vendor advisory |
| http://www.securityfocus.com/bid/55410 | vdb entry |
| http://www.openwall.com/lists/oss-security/2012/09/05/8 | mailing list |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/78268 | vdb entry |
| http://osvdb.org/85199 | vdb entry |
| http://lists.xen.org/archives/html/xen-announce/2012-09/msg00006.html | mailing list |
| http://secunia.com/advisories/50472 | third party advisory vendor advisory |
| https://security.gentoo.org/glsa/201604-03 | vendor advisory |