CVE-2013-1442
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data...
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
Exploit likelihood
What each source reports
NVD Score used
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
- Record
CVE-2013-1442- CVSS 2.0
- 1.2 Low
AV:L/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
- Record
CVE-2013-1442- Updated
- 2026-11-02
EUVDEUVD-2013-1480 No score
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
- Record
EUVD-2013-1480- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pq8f-m2fp-4jv5 No score
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data...
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
- Record
GHSA-pq8f-m2fp-4jv5- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
- Record
CVE-2013-1442- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1442 No score
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
- Record
DEBIAN-CVE-2013-1442- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10196-1 No score
xen-4.7.0_12-1.3 on GA media
These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10196-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenDebian:12 |
before 4.4.0-1 | 4.4.0-1 |
xenDebian:13 |
before 4.4.0-1 | 4.4.0-1 |
xenDebian:14 |
before 4.4.0-1 | 4.4.0-1 |
xenDebian:7 From an advisory covering 19 CVEs |
before 4.1.4-3+deb7u2, plus listed versions 4.1.4-34.1.4-3+deb7u1 |
4.1.4-3+deb7u2 |
xenopenSUSE:Tumbleweed From an advisory covering 124 CVEs |
before 4.7.0_12-1.3 | 4.7.0_12-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1442 is a low vulnerability (CVSS 1.2) in Xen, published September 30, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in xen 4.4.0-1.
References
openwall.com/lists/oss-security/2013/09/25/2
securitytracker.com/id/1029090
security.gentoo.org/glsa/glsa-201407-03.xml
lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
debian.org/security/2014/dsa-3006
Show 127 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-1442
github.com/advisories/GHSA-pq8f-m2fp-4jv5
security-tracker.debian.org/tracker/CVE-2013-1442
suse.com/security/cve/CVE-2011-1898