Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
CVSS Details
- CVSS 3.1 Base Score: 2.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade xen | Jul 30, 2024 | Sep 30, 2013 |
| Gentoo Linux | — | Upgrade app-emulations/xen.Upgrade app-emulations/xen-pvgrub.Upgrade app-emulations/xen-tools. | Oct 30, 2017 | Sep 30, 2013 |
| Suse | — | Upgrade xen-toolsUpgrade xen-kmp-desktopUpgrade xen-develUpgrade xen-kmp-traceUpgrade xen-libsUpgrade xen-kmp-defaultUpgrade sle-sdk-releaseUpgrade xen-doc-htmlUpgrade xen-libs-32bitUpgrade xen-kmp-paeUpgrade xen-doc-pdfUpgrade xenUpgrade xen-tools-domU | Dec 12, 2013 | Sep 30, 2013 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Sep 30, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub