Strix
26.1K

CVE-2013-4368

UnknownEPSS 0.37%

Last modified

CVE-2013-4368 is a vulnerability of currently unknown severity. The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.. EPSS estimates a 0.37% chance of exploitation in the next 30 days.

Description

The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.

Metrics

EPSS Probability
0.37%

28.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
XenXen<= 4.3.0
XenXen3.0.2
XenXen3.0.3
XenXen3.0.4
XenXen3.1.3
XenXen3.1.4
XenXen3.2.0
XenXen3.2.1
XenXen3.2.2
XenXen3.2.3
XenXen3.3.0
XenXen3.3.1
XenXen3.3.2
XenXen3.4.0
XenXen3.4.1
XenXen3.4.2
XenXen3.4.3
XenXen3.4.4
XenXen4.0.0
XenXen4.0.1
XenXen4.0.2
XenXen4.0.3
XenXen4.0.4
XenXen4.1.0
XenXen4.1.1
XenXen4.1.2
XenXen4.1.3
XenXen4.1.4
XenXen4.1.5
XenXen4.1.6.1
XenXen4.2.0
XenXen4.2.1
XenXen4.2.2
XenXen4.2.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2013-4368?
The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
How severe is CVE-2013-4368?
Severity scoring for CVE-2013-4368 is pending analysis. The EPSS model estimates a 0.37% probability of exploitation in the next 30 days.
How do I fix CVE-2013-4368?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2013

View all 2013CVEs →

Are you affected by CVE-2013-4368?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST