---
title: "CVE-2012-4544\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2012-4544?format=md
keywords: index, follow
---

# CVE-2012-4544

Publication date 31 October 2012

Last updated 24 July 2024

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

The PV domain builder in Xen 4.2 and earlier does not validate the size of
the kernel or ramdisk (1) before or (2) after decompression, which allows
local guest administrators to cause a denial of service (domain 0 memory
consumption) via a crafted (a) kernel or (b) ramdisk.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2012-4544?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| xen | 13.10 saucy | Fixed 4.2.0-1ubuntu2 |
| 13.04 raring | Fixed 4.2.0-1ubuntu2 |
| 12.10 quantal | Fixed 4.1.3-3ubuntu1.1 |
| 12.04 LTS precise | Fixed 4.1.2-2ubuntu2.3 |
| 11.10 oneiric | Fixed 4.1.1-2ubuntu4.3 |
| 10.04 LTS lucid | Not in release |
| 8.04 LTS hardy | Not in release |
| xen-3.1 | 13.10 saucy | Not in release |
| 13.04 raring | Not in release |
| 12.10 quantal | Not in release |
| 12.04 LTS precise | Not in release |
| 11.10 oneiric | Not in release |
| 10.04 LTS lucid | Not in release |
| 8.04 LTS hardy | Ignored end of life |
| xen-3.2 | 13.10 saucy | Not in release |
| 13.04 raring | Not in release |
| 12.10 quantal | Not in release |
| 12.04 LTS precise | Not in release |
| 11.10 oneiric | Not in release |
| 10.04 LTS lucid | Not in release |
| 8.04 LTS hardy | Ignored end of life |
| xen-3.3 | 13.10 saucy | Not in release |
| 13.04 raring | Not in release |
| 12.10 quantal | Not in release |
| 12.04 LTS precise | Not in release |
| 11.10 oneiric | Not in release |
| 10.04 LTS lucid | Ignored end of life |
| 8.04 LTS hardy | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2012-4544?format=md#patch-details)

## Notes

---

### [kees](https://launchpad.net/~kees)

for full-virtualization issues, add qemu (and kvm)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| xen | * Upstream:   <http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=127c78b8b7615b2e895a879792f4b0b825a02a81> |
| xen-3.1 | * Upstream:   <http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=127c78b8b7615b2e895a879792f4b0b825a02a81> |
| xen-3.2 | * Upstream:   <http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=127c78b8b7615b2e895a879792f4b0b825a02a81> |
| xen-3.3 | * Upstream:   <http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=127c78b8b7615b2e895a879792f4b0b825a02a81> |

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4544)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2012-4544)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2012-4544)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2012-4544)

### Other references

* <http://xforce.iss.net/xforce/xfdb/79617>
* <http://www.securitytracker.com/id?1027699>
* <http://www.openwall.com/lists/oss-security/2012/10/26/3>
* <http://secunia.com/advisories/51071>
* <http://osvdb.org/86619>
* <http://lists.xen.org/archives/html/xen-devel/2012-10/msg02015.html>
* <https://www.cve.org/CVERecord?id=CVE-2012-4544>