GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2012-3420

Vulnerability from fkie_nvd - Published: 2012-08-27 23:55 - Updated: 2026-06-16 23:43
Severity
Summary
Multiple memory leaks in Performance Co-Pilot (PCP) before 3.6.5 allow remote attackers to cause a denial of service (memory consumption or daemon crash) via a large number of PDUs with (1) a crafted context number to the DoFetch function in pmcd/src/dofetch.c or (2) a negative type value to the __pmGetPDU function in libpcp/src/pdu.c.
References
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html
secalert@redhat.comhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html
secalert@redhat.comhttp://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=blob%3Bf=CHANGELOG%3Bh=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5%3Bhb=fe51067ae869a4d59f350ac319b09edcb77ac8e6
secalert@redhat.comhttp://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=68fb968b4ee635bb301dc9ab64e633b0d66d27b4
secalert@redhat.comhttp://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=a7dc844d3586ea79887655a97c4252a79751fdae
secalert@redhat.comhttp://www.debian.org/security/2012/dsa-2533
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/08/16/1
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=841298
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=841319
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=841704
secalert@redhat.comhttps://hermes.opensuse.org/messages/15471040
secalert@redhat.comhttps://hermes.opensuse.org/messages/15540133
secalert@redhat.comhttps://hermes.opensuse.org/messages/15540172
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html
af854a3a-2127-422b-91ae-364da2661108http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=blob%3Bf=CHANGELOG%3Bh=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5%3Bhb=fe51067ae869a4d59f350ac319b09edcb77ac8e6
af854a3a-2127-422b-91ae-364da2661108http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=68fb968b4ee635bb301dc9ab64e633b0d66d27b4
af854a3a-2127-422b-91ae-364da2661108http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=a7dc844d3586ea79887655a97c4252a79751fdae
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2012/dsa-2533
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/08/16/1
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=841298
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=841319
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=841704
af854a3a-2127-422b-91ae-364da2661108https://hermes.opensuse.org/messages/15471040
af854a3a-2127-422b-91ae-364da2661108https://hermes.opensuse.org/messages/15540133
af854a3a-2127-422b-91ae-364da2661108https://hermes.opensuse.org/messages/15540172
Impacted products
Vendor Product Version
sgi performance_co-pilot *
sgi performance_co-pilot 2.1.1
sgi performance_co-pilot 2.1.2
sgi performance_co-pilot 2.1.3
sgi performance_co-pilot 2.1.4
sgi performance_co-pilot 2.1.5
sgi performance_co-pilot 2.1.6
sgi performance_co-pilot 2.1.7
sgi performance_co-pilot 2.1.8
sgi performance_co-pilot 2.1.9
sgi performance_co-pilot 2.1.10
sgi performance_co-pilot 2.1.11
sgi performance_co-pilot 2.2
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "61D11953-C33A-47B0-B47E-10FD9ACA7A8B",
              "versionEndIncluding": "3.6.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "81FC987D-ACD6-4495-87FE-5C3547CE22B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DECE1AE3-0247-4170-A02F-03D33A6DD33B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4E5A424-E298-4967-8174-CB6035126750",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCFD1859-A3F0-4A1C-B593-B9FBFDF165D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B5E5B48-F324-49DB-BD42-B8F9B9C3EA72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9D6FF9F-006D-45C9-B0A1-A2E450A75590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C8F4743-9016-453B-81E7-F3BEC6979FE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "817F8589-040B-4216-95A2-FE70000B1CDD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4B93DB7-2220-4CF6-B2F3-BB953023EE94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F9A53D4-333E-4DD1-A99D-AC35C808A138",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F08C5F0-6EF7-4539-9CED-D3F3E81EEA82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgi:performance_co-pilot:2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "551F7EA0-7323-4D0C-8DE2-EE08689DAFDE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple memory leaks in Performance Co-Pilot (PCP) before 3.6.5 allow remote attackers to cause a denial of service (memory consumption or daemon crash) via a large number of PDUs with (1) a crafted context number to the DoFetch function in pmcd/src/dofetch.c or (2) a negative type value to the __pmGetPDU function in libpcp/src/pdu.c."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples p\u00e9rdidas de memoria en Performance Co-Pilot (PCP) anterior a v3.6.5 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de memoria o un accidente demonio) a trav\u00e9s de un gran n\u00famero de PDUs con (1) un n\u00famero de contexto dise\u00f1ado al funci\u00f3n en DoFetch pmcd / src / dofetch.c o (2) un valor de tipo negativo para la funci\u00f3n pmGetPDU __ en libpcp / src / pdu.c."
    }
  ],
  "id": "CVE-2012-3420",
  "lastModified": "2026-06-16T23:43:11.240",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-08-27T23:55:02.227",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=blob%3Bf=CHANGELOG%3Bh=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5%3Bhb=fe51067ae869a4d59f350ac319b09edcb77ac8e6"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=68fb968b4ee635bb301dc9ab64e633b0d66d27b4"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=a7dc844d3586ea79887655a97c4252a79751fdae"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.debian.org/security/2012/dsa-2533"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/08/16/1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=841298"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=841319"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=841704"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://hermes.opensuse.org/messages/15471040"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://hermes.opensuse.org/messages/15540133"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://hermes.opensuse.org/messages/15540172"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=blob%3Bf=CHANGELOG%3Bh=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5%3Bhb=fe51067ae869a4d59f350ac319b09edcb77ac8e6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=68fb968b4ee635bb301dc9ab64e633b0d66d27b4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git%3Ba=commit%3Bh=a7dc844d3586ea79887655a97c4252a79751fdae"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2012/dsa-2533"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/08/16/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=841298"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=841319"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=841704"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://hermes.opensuse.org/messages/15471040"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://hermes.opensuse.org/messages/15540133"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://hermes.opensuse.org/messages/15540172"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.