Skip to content
Fencer Intel
low 3.8

CVE-2016-3159 json

The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 pro…

published 2016-04-13 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-4211

cvss
3.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.

Patch / fix

  • xen Debian 14, Debian 13, Debian 12 4.8.0~rc3-1

debian advisories DEBIAN-CVE-2016-3159

  • xen Ubuntu 14.04 LTS 4.4.2-0ubuntu0.14.04.6
  • xen Ubuntu 16.04 LTS 4.6.0-1ubuntu4.1

ubuntu advisories UBUNTU-CVE-2016-3159

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • xen SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3, OpenStack Cloud 5 +2 more 4.2.5_21-27.1
  • xen SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 4.4.4_07-37.1
  • xen SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 4.5.3_08-17.1
  • xen SLES for SAP 12, SLES 12-LTSS 4.4.4_04-22.22.2
  • xen SLES 11 SP2-LTSS 4.1.6_08-29.1

suse advisories SUSE-SU-2016:2725-1SUSE-SU-2016:2533-1SUSE-SU-2016:2528-1SUSE-SU-2016:2100-1SUSE-SU-2016:2093-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-3159 updated cvss 3.8

xen: AMD FPU FIP/FDP/FOP leak workaround broken (XSA-172)

  • Red Hat Enterprise Linux 5 xen
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 3.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
NVD 2.0 1.7 AV:L/AC:L/Au:S/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-284 Improper Access Control

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.