Published: 13/04/2016 Updated: 21/02/2019

CVSS v2 Base Score: 1.7 | Impact Score: 2.9 | Exploitability Score: 3.1

CVSS v3 Base Score: 3.8 | Impact Score: 1.4 | Exploitability Score: 2

VMScore: 151

Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N

The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle vm server 3.3
oracle vm server 3.4
xen xen
fedoraproject fedora 22
fedoraproject fedora 23
debian debian linux 8.0

Debian Bug report logs - #823620 Multiple security issues Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 6 May 2016 18:03:02 UTC Severity: grave Tags: security Fixed in versions xen/480~rc3-1, xen/48 ...

Multiple vulnerabilities have been discovered in the Xen hypervisor The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-3158, CVE-2016-3159 (XSA-172) Jan Beulich from SUSE discovered that Xen does not properly handle writes to the hardware FSWES bit when running on AMD64 processors A maliciou ...

The fpu_fxrstor function in arch/x86/i387c in Xen 4x does not properly handle writes to the hardware FSWES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits NOTE: this vulnerability exists because of an incorr ...

CWE-200 CWE-284 http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181729.html http://www.securitytracker.com/id/1035435 http://xenbits.xen.org/xsa/xsa172.patch http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181699.html http://xenbits.xen.org/xsa/advisory-172.html http://www.securityfocus.com/bid/85716 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://support.citrix.com/article/CTX209443 http://www.debian.org/security/2016/dsa-3554 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823620 https://www.debian.org/security/./dsa-3554 https://access.redhat.com/security/cve/cve-2016-3159

CVE-2016-3159

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect