Description
The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.1.3-5 | — |
| Debian 13 | xen | 4.1.3-5 | — |
| Debian 12 | xen | 4.1.3-5 | — |
| Debian 6.0 | xen | 4.0.1-5.5 | DSA-2582-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-308.24.1.el5 | RHSA-2012:1540 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Advisories 3
- RHSA-2012:1540 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2582-1 xen - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- RHSA-2012:1540 vendor-advisory
- SUSE-SU-2014:0470 vendor-advisory
- 55082 third-party-advisory
- openSUSE-SU-2013:0133 vendor-advisory
- [oss-security] 20121203 Xen Security Advisory 29 (CVE-2012-5513) - XENMEM_exchange may overwrite hypervisor memory mailing-list
- openSUSE-SU-2013:0637 vendor-advisory
- http://support.citrix.com/article/CTX135777
- GLSA-201309-24 vendor-advisory
- DSA-2582 vendor-advisory
- 51397 third-party-advisory
- openSUSE-SU-2012:1685 vendor-advisory
- 51486 third-party-advisory
- 51487 third-party-advisory
- 56797 vdb-entry
- 51468 third-party-advisory
- openSUSE-SU-2013:0636 vendor-advisory
- SUSE-SU-2014:0446 vendor-advisory
- xen-xenmemexchange-priv-esc(80482) vdb-entry
- openSUSE-SU-2012:1687 vendor-advisory
- 88131 vdb-entry
- SUSE-SU-2012:1615 vendor-advisory
- 51495 third-party-advisory
- SUSE-SU-2012:1606 vendor-advisory