CVE-2013-4361

Xen 3.3.x-4.3.x - Information Disclosure via fbld Instruction Emulation

Title source: llm
STIX 2.1

Description

The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.

References (5)

Core 5
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201407-03.xml
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/09/30/3
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3006
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html

Scores

EPSS 0.0011
EPSS Percentile 28.8%

Details

CWE
CWE-200
Status published
Products (23)
xen/xen 3.3.0
xen/xen 3.3.1
xen/xen 3.3.2
xen/xen 3.4.0
xen/xen 3.4.1
xen/xen 3.4.2
xen/xen 3.4.3
xen/xen 3.4.4
xen/xen 4.0.0
xen/xen 4.0.1
... and 13 more
Published Oct 01, 2013
Tracked Since Feb 18, 2026