CVE-2013-1442: Infoleak
Published Sep 30, 2013
·Updated
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
Affected Software
16 affected components
XEN Xen=4.0.0
XEN Xen=4.0.1
XEN Xen=4.0.2
XEN Xen=4.0.3
XEN Xen=4.0.4
XEN Xen=4.1.0
XEN Xen=4.1.1
XEN Xen=4.1.2
XEN Xen=4.1.3
XEN Xen=4.1.4
XEN Xen=4.1.5
XEN Xen=4.2.0
XEN Xen=4.2.1
XEN Xen=4.2.2
XEN Xen=4.2.3
XEN Xen=4.3.0
Event History
Sep 30, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-1442?
The severity of CVE-2013-1442 is classified as low with a score of 1.2.
2
How do I fix CVE-2013-1442?
To fix CVE-2013-1442, update to a version of Xen that is not affected, such as Xen 4.4.x or later.
3
Which versions of Xen are affected by CVE-2013-1442?
CVE-2013-1442 affects Xen versions 4.0.0 through 4.3.0.
4
What type of vulnerability is CVE-2013-1442?
CVE-2013-1442 is a vulnerability related to improper data clearing in CPU registers.
5
Can local guest OSes exploit CVE-2013-1442?
Yes, local guest OSes can exploit CVE-2013-1442 to obtain sensitive information from other guest OSes.