PT-2013-4976 · Xen+2 · Xen+2

Matthew Daley · Publicado 2013-10-17 · Atualizado 2017-08-29 · CVE-2013-4368

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions 3.1.x through 4.3.x

Description The issue allows local 64-bit PV guests to obtain sensitive information, specifically hypervisor stack content, via unspecified vectors related to stale data in a segment register. This occurs when using FS: or GS: segment override in the outs instruction emulation.

Recommendations For Xen versions 3.1.x through 4.3.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-4368

DSA-3006-1

RHSA-2013:1449

RHSA-2013_1449

Produtos afetados

Red Hat

Suse

Xen

Referências · 27

• https://github.com/torvalds/linux/commit/e9c6a182649f4259db704ae15a91ac820e63b0ca · Nota
• https://bdu.fstec.ru/vul/2014-00085 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87799 · Nota
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-4368 · Aviso do Fabricante
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9c6a182649f4259db704ae15a91ac820e63b0ca · Nota
• https://bdu.fstec.ru/vul/2015-04308 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4368 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2013-0343 · Nota
• https://bdu.fstec.ru/vul/2015-04309 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2013:1449 · Nota
• http://debian.org/security/2014/dsa-3006 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2013-4299 · Nota
• https://access.redhat.com/security/cve/CVE-2013-4345 · Nota