CVE-2013-4361
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for...
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.
Exploit likelihood
What each source reports
NVD Score used
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.
- Record
CVE-2013-4361- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.
- Record
CVE-2013-4361- Updated
- 2026-11-02
EUVDEUVD-2013-4245 No score
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.
- Record
EUVD-2013-4245- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jmgg-m7r5-7296 No score
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for...
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.
- Record
GHSA-jmgg-m7r5-7296- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.
- Record
CVE-2013-4361- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4361 No score
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.
- Record
DEBIAN-CVE-2013-4361- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10196-1 No score
xen-4.7.0_12-1.3 on GA media
These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10196-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenDebian:12 |
before 4.4.0-1 | 4.4.0-1 |
xenDebian:13 |
before 4.4.0-1 | 4.4.0-1 |
xenDebian:14 |
before 4.4.0-1 | 4.4.0-1 |
xenDebian:7 From an advisory covering 19 CVEs |
before 4.1.4-3+deb7u2, plus listed versions 4.1.4-34.1.4-3+deb7u1 |
4.1.4-3+deb7u2 |
xenopenSUSE:Tumbleweed From an advisory covering 124 CVEs |
before 4.7.0_12-1.3 | 4.7.0_12-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4361 is a low vulnerability (CVSS 2.1) in Xen, published October 1, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in xen 4.4.0-1.
References
security.gentoo.org/glsa/glsa-201407-03.xml
lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
openwall.com/lists/oss-security/2013/09/30/3
debian.org/security/2014/dsa-3006
nvd.nist.gov/vuln/detail/CVE-2013-4361
Show 126 moreShow less
github.com/advisories/GHSA-jmgg-m7r5-7296
security-tracker.debian.org/tracker/CVE-2013-4361
suse.com/security/cve/CVE-2011-1898