PT-2013-3138 · Xen+1 · Xen+1

Jan Beulich · Published 2013-09-30 · Updated 2024-06-15 · CVE-2013-1442

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions 4.0 through 4.3.x

Description The issue allows local guest OSes to obtain sensitive information by reading registers due to improper clearing of previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, specifically on AVX or LWP capable CPUs.

Recommendations For Xen versions 4.0 through 4.3.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-1442

DSA-3006-1

OPENSUSE-SU-2024:10196-1

Affected Products

Suse

Xen

References · 135

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-1442 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1442 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1442 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1442 · Vendor Advisory
• http://debian.org/security/2014/dsa-3006 · Vendor Advisory
• https://suse.com/security/cve/CVE-2014-3124 · Note
• https://suse.com/security/cve/CVE-2014-3672 · Note
• https://suse.com/security/cve/CVE-2015-7970 · Note
• https://suse.com/security/cve/CVE-2012-4411 · Note
• https://suse.com/security/cve/CVE-2016-2538 · Note
• https://suse.com/security/cve/CVE-2015-7969 · Note