CVE-2012-3495: Citrix Xenserver

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.

Affected products

• Citrix Xenserver: up to and including 6.0.2; version 5.0 only; version 5.5 only; version 5.6 only; version 6.0 only
• Xen Xen: version 4.1.0 only; version 4.1.1 only; version 4.1.2 only; version 4.1.3 only

Published 2012-11-23. Last modified 2026-06-16.