製品・ソフトウェアに関する情報

JVN脆弱性詳細

Xen におけるサービス運用妨害 (Xen の無限ループおよび物理 CPU の消費) の脆弱性

Title	Xen におけるサービス運用妨害 (Xen の無限ループおよび物理 CPU の消費) の脆弱性
Summary	Xen には、サービス運用妨害 (Xen の無限ループおよび物理 CPU の消費) 状態となる脆弱性が存在します。
Possible impacts	ローカルゲスト OS の管理者により、VCPU に "inappropriate deadline" を設定されることで、サービス運用妨害 (Xen の無限ループおよび物理 CPU の消費) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 13, 2012, midnight
Registration Date	Nov. 26, 2012, 3:32 p.m.
Last Update	Dec. 17, 2012, 12:28 p.m.

CVSS2.0 : 注意
Score	1.9
Vector	AV:L/AC:M/Au:N/C:N/I:N/A:P

Affected System

シトリックス・システムズ

Xen 3.4 から 4.2

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-4535	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4535
National Vulnerability Database (NVD)
2	CVE-2012-4535	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4535

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-2582	http://www.debian.org/security/2012/dsa-2582
opensuse-security-announce
2	SUSE-SU-2012:1615	http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html
Xen
3	Top Page	http://www.xen.org/
Xen-announce
4	Xen Security Advisory 20 (CVE-2012-4535) - Timer overflow DoS vulnerability	http://lists.xen.org/archives/html/xen-announce/2012-11/msg00001.html

Change Log

No	Changed Details	Date of change
0	[2012年11月26日] 掲載 [2012年12月17日] ベンダ情報：Debian (DSA-2582) を追加ベンダ情報：openSUSE (SUSE-SU-2012:1615) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-4535

Summary	Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an "inappropriate deadline."
Publication Date	Nov. 22, 2012, 8:55 a.m.
Registration Date	Jan. 28, 2021, 3:03 p.m.
Last Update	Nov. 21, 2024, 10:43 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:xen:xen:3.4.0:::::::*
cpe:2.3:o:xen:xen:4.0.4:::::::*
cpe:2.3:o:xen:xen:4.0.2:::::::*
cpe:2.3:o:xen:xen:4.1.2:::::::*
cpe:2.3:o:xen:xen:3.4.4:::::::*
cpe:2.3:o:xen:xen:4.0.0:::::::*
cpe:2.3:o:xen:xen:4.1.1:::::::*
cpe:2.3:o:xen:xen:4.2.0:::::::*
cpe:2.3:o:xen:xen:4.1.0:::::::*
cpe:2.3:o:xen:xen:3.4.3:::::::*
cpe:2.3:o:xen:xen:4.1.3:::::::*
cpe:2.3:o:xen:xen:3.4.2:::::::*
cpe:2.3:o:xen:xen:3.4.1:::::::*
cpe:2.3:o:xen:xen:4.0.1:::::::*
cpe:2.3:o:xen:xen:4.0.3:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.html
2	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00008.html
3	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html
4	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00009.html
5	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
6	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
7	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
8	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
9	http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html
10	http://lists.opensuse.org/opensuse-security-announce/2012-12/msg00001.html
11	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
12	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
13	http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
14	http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
15	http://lists.xen.org/archives/html/xen-announce/2012-11/msg00001.html	Vendor Advisory
16	http://lists.xen.org/archives/html/xen-announce/2012-11/msg00001.html	Vendor Advisory
17	http://osvdb.org/87298
18	http://osvdb.org/87298
19	http://rhn.redhat.com/errata/RHSA-2012-1540.html
20	http://rhn.redhat.com/errata/RHSA-2012-1540.html
21	http://secunia.com/advisories/51200
22	http://secunia.com/advisories/51200
23	http://secunia.com/advisories/51324
24	http://secunia.com/advisories/51324
25	http://secunia.com/advisories/51352
26	http://secunia.com/advisories/51352
27	http://secunia.com/advisories/51413
28	http://secunia.com/advisories/51413
29	http://secunia.com/advisories/51468
30	http://secunia.com/advisories/51468
31	http://secunia.com/advisories/55082
32	http://secunia.com/advisories/55082
33	http://security.gentoo.org/glsa/glsa-201309-24.xml
34	http://security.gentoo.org/glsa/glsa-201309-24.xml
35	http://www.debian.org/security/2012/dsa-2582
36	http://www.debian.org/security/2012/dsa-2582
37	http://www.openwall.com/lists/oss-security/2012/11/13/1
38	http://www.openwall.com/lists/oss-security/2012/11/13/1
39	http://www.securityfocus.com/bid/56498
40	http://www.securityfocus.com/bid/56498
41	http://www.securitytracker.com/id?1027759
42	http://www.securitytracker.com/id?1027759
43	https://exchange.xforce.ibmcloud.com/vulnerabilities/80022
44	https://exchange.xforce.ibmcloud.com/vulnerabilities/80022
45	https://security.gentoo.org/glsa/201604-03
46	https://security.gentoo.org/glsa/201604-03

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-399	リソース管理の問題	https://cwe.mitre.org/data/definitions/399.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:xen:xen:3.4.0:::::::*
cpe:2.3:o:xen:xen:4.0.4:::::::*
cpe:2.3:o:xen:xen:4.0.2:::::::*
cpe:2.3:o:xen:xen:4.1.2:::::::*
cpe:2.3:o:xen:xen:3.4.4:::::::*
cpe:2.3:o:xen:xen:4.0.0:::::::*
cpe:2.3:o:xen:xen:4.1.1:::::::*
cpe:2.3:o:xen:xen:4.2.0:::::::*
cpe:2.3:o:xen:xen:4.1.0:::::::*
cpe:2.3:o:xen:xen:3.4.3:::::::*
cpe:2.3:o:xen:xen:4.1.3:::::::*
cpe:2.3:o:xen:xen:3.4.2:::::::*
cpe:2.3:o:xen:xen:3.4.1:::::::*
cpe:2.3:o:xen:xen:4.0.1:::::::*
cpe:2.3:o:xen:xen:4.0.3:::::::*