CVE-2012-3495

CVE-2012-3495 is a medium-severity vulnerability in Citrix Xenserver with a CVSS 2.0 base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

• Severity: Medium (CVSS 2.0 base score 6.1)
• EPSS exploit prediction: 0% (35th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-20
• Affected product: Citrix Xenserver
• Published: 2012-11-23
• Last modified: 2026-06-16

Description

The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.

Frequently asked questions

What is CVE-2012-3495?

The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.

How severe is CVE-2012-3495?

CVE-2012-3495 has a CVSS 2.0 base score of 6.1, rated medium severity.

Is CVE-2012-3495 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2012-3495?

CVE-2012-3495 primarily affects Citrix Xenserver. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2012-3495?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2012-3495 published?

CVE-2012-3495 was published on 2012-11-23 and last updated on 2026-06-16.

References

• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00017.html
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00017.html
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00018.html
• http://lists.xen.org/archives/html/xen-announce/2012-09/msg00001.html
• http://secunia.com/advisories/51413
• http://secunia.com/advisories/55082
• http://security.gentoo.org/glsa/glsa-201309-24.xml
• http://support.citrix.com/article/CTX134708
• http://wiki.xen.org/wiki/Security_Announcements#XSA-13_hypercall_physdev_get_free_pirq_vulnerability
• http://www.openwall.com/lists/oss-security/2012/09/05/6
• http://www.securityfocus.com/bid/55406
• http://www.securitytracker.com/id?1027480
• http://xenbits.xen.org/hg/xen-4.1-testing.hg/rev/6779ddca8593
• https://security.gentoo.org/glsa/201604-03

Affected products (11)

• cpe:2.3:a:citrix:xenserver:*:*:*:*:*:*:*:*
• cpe:2.3:a:citrix:xenserver:5.0:*:*:*:*:*:*:*
• cpe:2.3:a:citrix:xenserver:5.5:*:*:*:*:*:*:*
• cpe:2.3:a:citrix:xenserver:5.6:*:*:*:*:*:*:*
• cpe:2.3:a:citrix:xenserver:5.6:fp1:*:*:*:*:*:*
• cpe:2.3:a:citrix:xenserver:5.6:sp2:*:*:*:*:*:*
• cpe:2.3:a:citrix:xenserver:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*

More vulnerabilities in Citrix Xenserver

• CVE-2014-4947 — Critical (CVSS 10.0): Buffer overflow in the HVM graphics console support in Citrix XenServer 6.2 Service Pack 1 and earlier has unspecified…
• CVE-2018-14007 — Critical (CVSS 9.8): Citrix XenServer 7.1 and newer allows Directory Traversal.
• CVE-2015-7705 — Critical (CVSS 9.8): The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified…
• CVE-2016-5302 — Critical (CVSS 9.8): Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow…
• CVE-2017-12137 — High (CVSS 8.8): arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.
• CVE-2017-12135 — High (CVSS 8.8): Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain…

All CVEs affecting Citrix Xenserver →

Other CWE-20 (Improper Input Validation) vulnerabilities

• CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
• CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
• CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →