CVE-2013-1442
First published: Mon Sep 30 2013(Updated: )
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen Xen | =4.0.0 | |
| Xen Xen | =4.0.1 | |
| Xen Xen | =4.0.2 | |
| Xen Xen | =4.0.3 | |
| Xen Xen | =4.0.4 | |
| Xen Xen | =4.1.0 | |
| Xen Xen | =4.1.1 | |
| Xen Xen | =4.1.2 | |
| Xen Xen | =4.1.3 | |
| Xen Xen | =4.1.4 | |
| Xen Xen | =4.1.5 | |
| Xen Xen | =4.2.0 | |
| Xen Xen | =4.2.1 | |
| Xen Xen | =4.2.2 | |
| Xen Xen | =4.2.3 | |
| Xen Xen | =4.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00009.html
- http://security.gentoo.org/glsa/glsa-201407-03.xml
- http://www.debian.org/security/2014/dsa-3006
- http://www.openwall.com/lists/oss-security/2013/09/25/2
- http://www.securitytracker.com/id/1029090
Frequently Asked Questions
What is the severity of CVE-2013-1442?
The severity of CVE-2013-1442 is classified as low with a score of 1.2.
How do I fix CVE-2013-1442?
To fix CVE-2013-1442, update to a version of Xen that is not affected, such as Xen 4.4.x or later.
Which versions of Xen are affected by CVE-2013-1442?
CVE-2013-1442 affects Xen versions 4.0.0 through 4.3.0.
What type of vulnerability is CVE-2013-1442?
CVE-2013-1442 is a vulnerability related to improper data clearing in CPU registers.
Can local guest OSes exploit CVE-2013-1442?
Yes, local guest OSes can exploit CVE-2013-1442 to obtain sensitive information from other guest OSes.
- collector/nvd-index
- vendor/xen
- product/xen
- canonical/xen xen