Information disclosure in Xen - CVE-2016-9932

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32193

Information disclosure in Xen - CVE-2016-9932

Published: January 26, 2017 / Updated: July 28, 2020


Vulnerability identifier: #VU32193
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-9932
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local authenticated user to gain access to sensitive information.

CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.


Affected software

Xen
xen (Alpine package)
SUSE Linux
Opensuse

How to mitigate CVE-2016-9932

Install update from vendor's website.

xen (Alpine package) - update to 4.5.3-r3

External References

Related Security Bulletins