Information disclosure in Xen

CVE-2013-4355

Xen 4.3.x and earlier does not properly handle certain errors, which allows local HVM guests to obtain hypervisor stack memory via a (1) port or (2) memory mapped I/O write or (3) other unspecified operations related to addresses without associated memory.

Vulnerability class: Information Disclosure

EPSS: 0.003 (23.3th percentile) — read the EPSS interpretation.

Affected products

  • Xen — versions 3.0.2, 3.0.3, 3.0.4
  • N/a — versions n/a

Weakness classification (CWE)

References