The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-xen-develUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-debugUpgrade kernel-PAEUpgrade kernel-docUpgrade kernel-headersUpgrade kernel-PAE-develUpgrade kernelUpgrade kernel-xen | Dec 1, 2016 | Oct 17, 2013 |
| Debian | — | Upgrade xen | Jul 30, 2024 | Oct 17, 2013 |
| Gentoo Linux | — | Upgrade app-emulations/xen-pvgrub.Upgrade app-emulations/xen-tools.Upgrade app-emulations/xen. | Oct 30, 2017 | Oct 17, 2013 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Oct 17, 2013 |
| Suse | — | Upgrade xen-develUpgrade xen-tools-ioemuUpgrade xen-kmp-debugUpgrade xen-kmp-smpUpgrade xen-kmp-vmiUpgrade xen-toolsUpgrade xen-libs-32bitUpgrade xen-doc-psUpgrade xenUpgrade xen-kmp-kdumppaeUpgrade xen-kmp-vmipaeUpgrade xen-kmp-desktopUpgrade xen-kmp-bigsmpUpgrade xen-kmp-defaultUpgrade xen-kmp-kdumpUpgrade xen-doc-pdfUpgrade sle-sdk-releaseUpgrade xen-kmp-paeUpgrade xen-kmp-traceUpgrade xen-libsUpgrade xen-doc-htmlUpgrade xen-tools-domU | Dec 12, 2013 | Oct 17, 2013 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Oct 17, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub