VulnerabilityModified
CVE-2016-9932
CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.
LOW 3.3EPSS 0.42%
Does this matter?
Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.
Description
CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix.
- CVSS 3.0
- 3.3 LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.42% probability · 36th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- xen/xen
- Source
- cve@mitre.org
References
- http://www.debian.org/security/2017/dsa-3847
- http://www.securityfocus.com/bid/94863Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037468Third Party Advisory, VDB Entry
- http://xenbits.xen.org/xsa/advisory-200.htmlPatch, Vendor Advisory
- https://security.gentoo.org/glsa/201612-56
- https://support.citrix.com/article/CTX219378Vendor Advisory
- http://www.debian.org/security/2017/dsa-3847
- http://www.securityfocus.com/bid/94863Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1037468Third Party Advisory, VDB Entry
- http://xenbits.xen.org/xsa/advisory-200.htmlPatch, Vendor Advisory
- https://security.gentoo.org/glsa/201612-56
- https://support.citrix.com/article/CTX219378Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.