Information disclosure in Xen - CVE-2016-3159
Published: April 13, 2016 / Updated: July 28, 2020
Vulnerability identifier: #VU32302
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2016-3159
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to gain access to sensitive information.
The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.
Affected software
Xen
xen (Alpine package)
xen
Fedora
IBM Systems Director
xen (Alpine package)
xen
Fedora
IBM Systems Director
How to mitigate CVE-2016-3159
Install update from vendor's website.
xen (Alpine package) - update to 4.3.4-r3
xen - addressed in versions 4.5.2-10.fc22, 4.5.2-10.fc23, 4.5.3-1.fc22, 4.5.3-1.fc23
IBM Systems Director - update to 6.3.2.2
xen - addressed in versions 4.5.2-10.fc22, 4.5.2-10.fc23, 4.5.3-1.fc22, 4.5.3-1.fc23
IBM Systems Director - update to 6.3.2.2
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181699.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181729.html
- http://support.citrix.com/article/CTX209443
- http://www.debian.org/security/2016/dsa-3554
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/85716
- http://www.securitytracker.com/id/1035435
- http://xenbits.xen.org/xsa/advisory-172.html
- http://xenbits.xen.org/xsa/xsa172.patch