CVE-2012-2934 Denial of service in n/a

Low 1.9 Published 3 Dec 2012 Updated 6 Aug 2024

Local guest users on older AMD CPUs can hang the Xen host by executing instructions across a non-canonical boundary, requiring specific hardware and configuration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2012-2934?

CVE-2012-2934 is a low-severity denial of service vulnerability in Xen Xen, published on 3 Dec 2012. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.

Which versions are affected by CVE-2012-2934?

It affects 1 product.

Products include Xen Xen.

How do I fix CVE-2012-2934?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2012-2934 being exploited?

There is no known exploitation of CVE-2012-2934 in the wild and no public exploit code.

All Xen Xen vulnerabilities

Sources

Also known as DEBIAN-CVE-2012-2934, GHSA-48m3-5gf3-cq84.