PT-2013-4976 · Xen+2 · Xen+2

Matthew Daley · Published 2013-10-17 · Updated 2017-08-29 · CVE-2013-4368

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions 3.1.x through 4.3.x

Description The issue allows local 64-bit PV guests to obtain sensitive information, specifically hypervisor stack content, via unspecified vectors related to stale data in a segment register. This occurs when using FS: or GS: segment override in the outs instruction emulation.

Recommendations For Xen versions 3.1.x through 4.3.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-4368

DSA-3006-1

RHSA-2013:1449

RHSA-2013_1449

Affected Products

Red Hat

Suse

Xen

References · 27

• https://bdu.fstec.ru/vul/2014-00085 · Security Note
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4368 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04308 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4368 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04309 · Security Note
• http://debian.org/security/2014/dsa-3006 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4368 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04310 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1449.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00091 · Security Note
• https://bdu.fstec.ru/vul/2014-00092 · Security Note