Description
The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.1.3-4 | — |
| Debian 13 | xen | 4.1.3-4 | — |
| Debian 12 | xen | 4.1.3-4 | — |
| Debian 6.0 | xen | 4.0.1-5.7 | DSA-2636-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xen +1 | 3.0.3-142.el5_9.1 | RHSA-2013:0241 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | xen +1 | 3.0.3-142.el5_9.1 | RHSA-2013:0241 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Advisories 3
- RHSA-2013:0241 Red Hat Security Advisory: xen security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2636-1 xen - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- SUSE-SU-2014:0470 vendor-advisory
- 51071 third-party-advisory
- [oss-security] 20121026 Xen Security Advisory 25 (CVE-2012-4544) - Xen domain builder Out-of-memory due to malicious kernel/ramdisk mailing-list
- FEDORA-2012-17408 vendor-advisory
- 51413 third-party-advisory
- FEDORA-2012-17204 vendor-advisory
- SUSE-SU-2012:1486 vendor-advisory
- DSA-2636 vendor-advisory
- xen-pvdomainbuilder-dos(79617) vdb-entry
- FEDORA-2012-17135 vendor-advisory
- 56289 vdb-entry
- 1027699 vdb-entry
- RHSA-2013:0241 vendor-advisory
- openSUSE-SU-2012:1572 vendor-advisory
- 86619 vdb-entry
- SUSE-SU-2012:1487 vendor-advisory
- SUSE-SU-2014:0446 vendor-advisory
- 51352 third-party-advisory
- 51324 third-party-advisory
- SUSE-SU-2014:0411 vendor-advisory
- openSUSE-SU-2012:1573 vendor-advisory