CVE-2012-4544
Fixed in a distro release EPSS <1%
The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
Products: xen
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | xen | 4.1.3-4 |
| Debian 13 | xen | 4.1.3-4 |
| Debian 14 | xen | 4.1.3-4 |
| Debian 6.0 | xen | 4.0.1-5.7 |
| Red Hat Enterprise Linux 5 | xen | 0:3.0.3-142.el5_9.1 |
| Red Hat Enterprise Linux 5 | xen-debuginfo | 0:3.0.3-142.el5_9.1 |
| Red Hat Enterprise Linux 5 | xen-libs | 0:3.0.3-142.el5_9.1 |
| Red Hat rhel virtualization 5 | xen | 0:3.0.3-142.el5_9.1 |
| Red Hat rhel virtualization 5 | xen-debuginfo | 0:3.0.3-142.el5_9.1 |
| Red Hat rhel virtualization 5 | xen-devel | 0:3.0.3-142.el5_9.1 |
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 |