CVE-2013-4368
published 2013-10-17CVE-2013-4368: The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment…
PriorityP48low1.9CVSS 2.0
AVLACMAuNCPINAN
EPSS
0.37%
28.8th percentile
The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.4.0-1 (bookworm) | xen 4.4.0-1 (bookworm) |
| xen | xen | <= 4.3.0 | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
CVSS provenance
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
osv1.9LOW
vendor_debian1.9LOW
vendor_redhat1.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x5cw-86rm-555x: The outs instruction emulation in Xen 3
ghsa_unreviewed·2022-05-17
CVE-2013-4368 [LOW] CWE-200 GHSA-x5cw-86rm-555x: The outs instruction emulation in Xen 3
The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
OSV
CVE-2013-4368: The outs instruction emulation in Xen 3
osv·2013-10-17·CVSS 1.9
CVE-2013-4368 [LOW] CVE-2013-4368: The outs instruction emulation in Xen 3
The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
Red Hat
xen: information leak through outs instruction emulation (XSA-67)
vendor_redhat·2013-10-10·CVSS 1.9
CVE-2013-4368 [LOW] xen: information leak through outs instruction emulation (XSA-67)
xen: information leak through outs instruction emulation (XSA-67)
The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
Debian
CVE-2013-4368: xen - The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when usi...
vendor_debian·2013·CVSS 1.9
CVE-2013-4368 [LOW] CVE-2013-4368: xen - The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when usi...
The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.
Scope: local
bookworm: resolved (fixed in 4.4.0-1)
bullseye: resolved (fixed in 4.4.0-1)
forky: resolved (fixed in 4.4.0-1)
sid: resolved (fixed in 4.4.0-1)
trixie: resolved (fixed in 4.4.0-1)
Citrix
Citrix Security Bulletin CTX138633
vendor_citrix·CVSS 7.5
CVE-2013-2601 [HIGH] Citrix Security Bulletin CTX138633
Citrix Security Bulletin CTX138633
CVE References: CVE-2013-2601, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
Citrix
Citrix Security Bulletin CTX136623
vendor_citrix·CVSS 5.0
CVE-2013-2263 [MEDIUM] Citrix Security Bulletin CTX136623
Citrix Security Bulletin CTX136623
CVE References: CVE-2013-2263, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
Citrix
Citrix Security Bulletin CTX135815
vendor_citrix·CVSS 5.0
CVE-2013-2756 [MEDIUM] Citrix Security Bulletin CTX135815
Citrix Security Bulletin CTX135815
CVE References: CVE-2013-2756, CVE-2013-2757, CVE-2013-2758, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
Citrix
Citrix Security Bulletin CTX140113
vendor_citrix·CVSS 5.0
CVE-2013-6938 [MEDIUM] Citrix Security Bulletin CTX140113
Citrix Security Bulletin CTX140113
CVE References: CVE-2013-6938, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
Citrix
Citrix Security Bulletin CTX139049
vendor_citrix·CVSS 5.0
CVE-2013-6938 [MEDIUM] Citrix Security Bulletin CTX139049
Citrix Security Bulletin CTX139049
CVE References: CVE-2013-6938, CVE-2013-6939, CVE-2013-6940, CVE-2013-6941, CVE-2013-6942, CVE-2013-6943, CVE-2013-6944, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
Citrix
Citrix Security Bulletin CTX138627
vendor_citrix·CVSS 5.8
CVE-2013-6077 [MEDIUM] Citrix Security Bulletin CTX138627
Citrix Security Bulletin CTX138627
CVE References: CVE-2013-6077, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
Citrix
Citrix Security Bulletin CTX137162
vendor_citrix·CVSS 10.0
CVE-2013-2933 [CRITICAL] Citrix Security Bulletin CTX137162
Citrix Security Bulletin CTX137162
CVE References: CVE-2013-2933, CVE-2013-2934, CVE-2013-2935, CVE-2013-2936, CVE-2013-2937, CVE-2013-2938, CVE-2013-2939, CVE-2013-2940, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
Citrix
Citrix Security Bulletin CTX216642
vendor_citrix·CVSS 8.1
CVE-2013-3619 [HIGH] Citrix Security Bulletin CTX216642
Citrix Security Bulletin CTX216642
CVE References: CVE-2013-3619, CVE-2013-3620, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-4371 CVE-2013-4370 CVE-2013-4368 CVE-2013-4369 CVE-2013-4375 xen: various flaws [fedora-all]
bugzilla·2013-10-10·CVSS 1.9
CVE-2013-4371 [LOW] CVE-2013-4371 CVE-2013-4370 CVE-2013-4368 CVE-2013-4369 CVE-2013-4375 xen: various flaws [fedora-all]
CVE-2013-4371 CVE-2013-4370 CVE-2013-4368 CVE-2013-4369 CVE-2013-4375 xen: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Ple
Bugzilla
CVE-2013-4368 xen: information leak through outs instruction emulation (XSA-67)
bugzilla·2013-09-26·CVSS 1.9
CVE-2013-4368 [LOW] CVE-2013-4368 xen: information leak through outs instruction emulation (XSA-67)
CVE-2013-4368 xen: information leak through outs instruction emulation (XSA-67)
The emulation of the outs instruction for 64-bit PV guests uses an
uninitialized variable as the segment base for the source data if an FS: or
GS: segment override is used, and if the segment descriptor the respective
non-null selector in the corresponding selector register points to cannot be
read by the emulation code (this is possible if the segment register was
loaded before a more recent GDT or LDT update, i.e. the segment register
contains stale data).
A malicious guest might be able to get hold of contents of the hypervisor
stack, through the fault address passed to the page fault handler if the outs
raises such a fault (which is mostly under guest control). Other methods for
indirectly deducing inform
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.htmlhttp://lists.opensuse.org/opensuse-updates/2013-11/msg00009.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1449.htmlhttp://security.gentoo.org/glsa/glsa-201407-03.xmlhttp://www.debian.org/security/2014/dsa-3006http://www.openwall.com/lists/oss-security/2013/10/10/10https://exchange.xforce.ibmcloud.com/vulnerabilities/87799http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.htmlhttp://lists.opensuse.org/opensuse-updates/2013-11/msg00009.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1449.htmlhttp://security.gentoo.org/glsa/glsa-201407-03.xmlhttp://www.debian.org/security/2014/dsa-3006http://www.openwall.com/lists/oss-security/2013/10/10/10https://exchange.xforce.ibmcloud.com/vulnerabilities/87799
2013-10-17
Published