Vulnerability Details CVE-2013-2072
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.6%
CVSS Severity
CVSS v2 Score 7.4
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106718.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106721.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106778.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
- http://www.debian.org/security/2014/dsa-3041
- http://www.openwall.com/lists/oss-security/2013/05/17/2
- http://www.securityfocus.com/bid/59982
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106718.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106721.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106778.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
- http://www.debian.org/security/2014/dsa-3041
- http://www.openwall.com/lists/oss-security/2013/05/17/2
- http://www.securityfocus.com/bid/59982
Products affected by CVE-2013-2072
-
cpe:2.3:o:debian:debian_linux:7.0
-
cpe:2.3:o:xen:xen:4.0.0
-
cpe:2.3:o:xen:xen:4.0.1
-
cpe:2.3:o:xen:xen:4.0.2
-
cpe:2.3:o:xen:xen:4.0.3
-
cpe:2.3:o:xen:xen:4.0.4
-
cpe:2.3:o:xen:xen:4.1.0
-
cpe:2.3:o:xen:xen:4.1.1
-
cpe:2.3:o:xen:xen:4.1.2
-
cpe:2.3:o:xen:xen:4.1.3
-
cpe:2.3:o:xen:xen:4.1.4
-
cpe:2.3:o:xen:xen:4.1.5
-
cpe:2.3:o:xen:xen:4.2.0
-
cpe:2.3:o:xen:xen:4.2.1
-
cpe:2.3:o:xen:xen:4.2.2