Description
The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.4.1-8 | — |
| Debian 13 | xen | 4.4.1-8 | — |
| Debian 12 | xen | 4.4.1-8 | — |
| Debian 7 | xen | 4.1.4-3+deb7u5 | DSA-3181-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | xen | 4.4.1-0ubuntu0.14.04.4 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | xen | 4.4.1_10-9.1 | SUSE-SU-2015:0613-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | xen | 4.4.1_10-9.1 | SUSE-SU-2015:0613-1 |
Advisories 2
- DSA-3181-1 xen - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2015:0613-1 Security update for Xen SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm
- GLSA-201504-04 vendor-advisory
- http://support.citrix.com/article/CTX200484
- FEDORA-2015-3944 vendor-advisory
- FEDORA-2015-3721 vendor-advisory
- http://xenbits.xen.org/xsa/advisory-121.html
- 1031836 vdb-entry
- 72954 vdb-entry
- DSA-3181 vendor-advisory
- FEDORA-2015-3935 vendor-advisory
- openSUSE-SU-2015:0732 vendor-advisory
- 1031806 vdb-entry