UpHeron
All vulnerabilities

Servers and applications

CVE-2016-3158

The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

Severity
Low 3.8
Published
13 Apr 2016
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
0.4% in the next 30 daysHigher than 35% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Information exposure (CWE-200)Improper access control (CWE-284)
Attack
Needs local access · Needs a user account · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
XenServers and applications · cpe:o:xen:xen
  • Every version up to 4.4.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-3158
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-3158