CVE-2016-3159: Infoleak
The fpufxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3159?
The severity of CVE-2016-3159 is classified as medium, as it allows unauthorized access to sensitive information across guest OS environments.
How do I fix CVE-2016-3159?
To fix CVE-2016-3159, update your Xen or Oracle VM Server to a version that addresses this vulnerability.
Which software versions are affected by CVE-2016-3159?
CVE-2016-3159 affects several versions of Xen from 4.3.0 to 4.6.1 and specific releases of Oracle VM Server 3.3 and 3.4.
What type of vulnerability is identified in CVE-2016-3159?
CVE-2016-3159 is a local information disclosure vulnerability that can be exploited by a guest OS user.
Can CVE-2016-3159 be exploited remotely?
No, CVE-2016-3159 requires local access to the affected guest OS to be exploited.