Description
The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service (host crash) by writing to the reserved bits of the DR7 debug control register.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.1.3-2 | — |
| Debian 13 | xen | 4.1.3-2 | — |
| Debian 12 | xen | 4.1.3-2 | — |
| Debian 6.0 | xen | 4.0.1-5.4 | DSA-2544-1 |
Advisories 1
- DSA-2544-1 xen - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- 55082 third-party-advisory
- 50530 third-party-advisory
- 51413 third-party-advisory
- GLSA-201309-24 vendor-advisory
- SUSE-SU-2012:1135 vendor-advisory
- http://wiki.xen.org/wiki/Security_Announcements#XSA-12_hypercall_set_debugreg_vulnerability
- https://bugzilla.redhat.com/show_bug.cgi?id=851139
- openSUSE-SU-2012:1572 vendor-advisory
- 50472 third-party-advisory
- 55400 vdb-entry
- [oss-security] 20120905 Xen Security Advisory 12 (CVE-2012-3494) - hypercall set_debugreg vulnerability mailing-list
- SUSE-SU-2012:1162 vendor-advisory
- openSUSE-SU-2012:1174 vendor-advisory
- GLSA-201604-03 vendor-advisory
- xen-setdebugreg-dos(78265) vdb-entry
- SUSE-SU-2012:1132 vendor-advisory
- http://support.citrix.com/article/CTX134708
- [Xen-announce] 20120905 Xen Security Advisory 12 (CVE-2012-3494) - hypercall set_debugreg vulnerability mailing-list
- SUSE-SU-2012:1129 vendor-advisory
- SUSE-SU-2012:1133 vendor-advisory
- 85197 vdb-entry
- 1027479 vdb-entry
- openSUSE-SU-2012:1573 vendor-advisory
- openSUSE-SU-2012:1172 vendor-advisory
- DSA-2544 vendor-advisory