Description
The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.1.3-1 | — |
| Debian 13 | xen | 4.1.3-1 | — |
| Debian 12 | xen | 4.1.3-1 | — |
| Debian 6.0 | xen | 4.0.1-5.3 | DSA-2531-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Advisories 2
- DSA-2531-1 xen - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- DSA-2531 vendor-advisory
- 55082 third-party-advisory
- [Xen-devel] 20120727 Xen Security Advisory 10 (CVE-2012-3432) - HVM user mode MMIO emul DoS mailing-list
- GLSA-201309-24 vendor-advisory
- SUSE-SU-2012:1044 vendor-advisory
- SUSE-SU-2012:1043 vendor-advisory
- openSUSE-SU-2012:1174 vendor-advisory
- 54691 vdb-entry
- openSUSE-SU-2012:1172 vendor-advisory