CVE-2016-3159 The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitiv...
LowCVSS 3.8
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xen(Debian:12) | < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| debian/xen(Debian:13) | < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| debian/xen(Debian:14) | < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| oracle vm server | = 3.3 | No fix listed |
| oracle vm server | = 3.4 | No fix listed |
| Xen | >= 4.3.0, <= 4.3.4 | No fix listed |
| Xen | >= 4.4.0, <= 4.4.4 | No fix listed |
| Xen | >= 4.5.0, <= 4.5.3 | No fix listed |
| Xen | >= 4.6.0, <= 4.6.1 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-3159 vendor-advisory
- FEDORA-2016-5f196e4e4a mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-e5432ca977 mailing-list third-party-advisory vendor-advisory
- support.citrix.com third-party-advisory
- DSA-3554 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- 85716 third-party-advisory vdb-entry
- 1035435 third-party-advisory vdb-entry
- xenbits.xen.org patch vendor-advisory
- xenbits.xen.org patch vendor-advisory
- bugs.debian.org issue-tracking