CVE-2013-2076: xen
Vulnerability summary
CVE-2013-2076 is a medium (CVSS 4.3) vulnerability in xen. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 42.5% of scored vulnerabilities.
Not severe (CVSS 4.3, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2Timeline
- 28-08-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged to obtain sensitive information such as cryptographic keys, a similar vulnerability to CVE-2006-1056. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.50% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, authentication (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- xen< 4.2.2-1
Xen1 product
- xen4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.2.0 | 4.2.1 | 4.2.2 | 4.1.0 | 4.1.1 | 4.1.2 | 4.1.3 | 4.1.4 | 4.1.5
2 vendors · 2 products
