CVE-2013-1442
Published: 30 September 2013
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
Notes
| Author | Note |
|---|---|
| seth-arnold | Problem can be mitigated with the "no-xsave" hypervisor command line option, which should be the default in 12.04 LTS and 12.10. |
| mdeslaur | This is XSA-62 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
xen Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
| precise |
Released
(4.1.5-0ubuntu0.12.04.2)
|
|
| quantal |
Released
(4.1.5-0ubuntu0.12.10.2)
|
|
| raring |
Released
(4.2.2-0ubuntu0.13.04.2)
|
|
| saucy |
Released
(4.3.0-1ubuntu1.1)
|
|
| upstream |
Needed
|
|
|
Patches: upstream: http://lists.xen.org/archives/html/xen-announce/2013-09/bind3QfiYrWBs.bin upstream: http://lists.xen.org/archives/html/xen-announce/2013-09/bini6tc760v1O.bin |
||
| Binaries built from this source package are in Universe and so are supported by the community. | ||
|
xen-3.3 Launchpad, Ubuntu, Debian |
lucid |
Not vulnerable
|
| precise |
Does not exist
|
|
| quantal |
Does not exist
|
|
| raring |
Does not exist
|
|
| saucy |
Does not exist
|
|
| upstream |
Ignored
(end of life)
|
|
| Binaries built from this source package are in Universe and so are supported by the community. | ||