Servers and applications
CVE-2016-7777
Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.
- Severity
- Medium 6.3
- Published
- 7 Oct 2016
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 0.3% in the next 30 daysHigher than 23% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Race condition (CWE-362)
- Attack
- Needs local access · Only under certain conditions · Needs a user account · No user action needed
- Attacker can
- Read data · Change data
- CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
XenServers and applications · cpe:o:xen:xen |
|