Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2013-2076 | First vendor Publication | 2013-08-28 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:H/Au:S/C:C/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Adjacent network |
| Cvss Impact Score | 6.9 | Attack Complexity | High |
| Cvss Expoit Score | 2.5 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged to obtain sensitive information such as cryptographic keys, a similar vulnerability to CVE-2006-1056. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2076 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-200 | Information Exposure |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:25878 | |||
| Oval ID: | oval:org.mitre.oval:def:25878 | ||
| Title: | SUSE-SU-2013:1314-1 -- Security update for Xen | ||
| Description: | The Xen hypervisor and toolset has been updated to 4.2.2_06 to fix various bugs and security issues: The following security issues have been addressed: * CVE-2013-2194: Various integer overflows in the ELF loader were fixed. (XSA-55) * CVE-2013-2195: Various pointer dereferences issues in the ELF loader were fixed. (XSA-55) * CVE-2013-2196: Various other problems in the ELF loader were fixed. (XSA-55) * CVE-2013-2078: A Hypervisor crash due to missing exception recovery on XSETBV was fixed. (XSA-54) * CVE-2013-2077: A Hypervisor crash due to missing exception recovery on XRSTOR was fixed. (XSA-53) * CVE-2013-2211: libxl allowed guest write access to sensitive console related xenstore keys. (XSA-57) * CVE-2013-2076: An information leak on XSAVE/XRSTOR capable AMD CPUs (XSA-52) was fixed, where parts of this state could leak to other VMs. Also the following bugs have been fixed: * performance issues in mirror lvm (bnc#801663) * aacraid driver panics mapping INT A when booting kernel-xen (bnc#808085) * Fully Virtualized Windows VM install failed on Ivy Bridge platforms with Xen kernel (bnc#808269) * Did not boot with i915 graphics controller with VT-d enabled (bnc#817210) | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2013:1314-1 CVE-2013-2194 CVE-2013-2195 CVE-2013-2196 CVE-2013-2078 CVE-2013-2077 CVE-2013-2211 CVE-2013-2076 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | Xen |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-06-12 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2015-0068.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-0446-1.nasl - Type : ACT_GATHER_INFO |
| 2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2013-0042.nasl - Type : ACT_GATHER_INFO |
| 2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2013-0043.nasl - Type : ACT_GATHER_INFO |
| 2014-08-19 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3006.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-669.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-677.nasl - Type : ACT_GATHER_INFO |
| 2013-09-28 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201309-24.nasl - Type : ACT_GATHER_INFO |
| 2013-08-10 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_xen-201307-130714.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Fedora host is missing a security update. File : fedora_2013-10136.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Fedora host is missing a security update. File : fedora_2013-10247.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Fedora host is missing a security update. File : fedora_2013-9986.nasl - Type : ACT_GATHER_INFO |
| 2013-06-26 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_xen-201305-130531.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 12:34:35 |
|
| 2023-11-07 21:45:58 |
|
| 2023-02-13 05:28:25 |
|
| 2021-05-04 12:24:52 |
|
| 2021-04-22 01:29:48 |
|
| 2020-05-23 00:36:51 |
|
| 2016-04-26 23:04:26 |
|
| 2015-06-13 13:27:50 |
|
| 2015-05-21 13:30:23 |
|
| 2014-12-12 09:22:33 |
|
| 2014-11-27 13:28:21 |
|
| 2014-08-20 13:25:52 |
|
| 2014-06-14 13:35:22 |
|
| 2014-04-19 13:23:42 |
|
| 2014-02-17 11:18:56 |
|
| 2013-10-11 13:26:06 |
|
| 2013-08-29 17:20:21 |
|
| 2013-08-29 13:20:51 |
|
