x86: Incorrect stubs exception handling for flags recovery
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.6%
exploitation probability
0.6%top 52% of all CVEs
observed exploitation
nono source reports it
In short
Xen hypervisor incorrectly handles exceptions when replaying certain x86 instructions that need to recover arithmetic flags, treating recoverable errors as fatal crashes instead of handling them gracefully.
Technical detail
CWE-755 vulnerability in Xen's stub-based instruction emulation where exception metadata is misconfigured for replayed instructions with flags recovery logic, causing unhandled exceptions to terminate the system instead of being caught and processed by exception handlers. Affects x86 platforms running Xen when specific instruction patterns trigger both exception conditions and flags recovery requirements.
Summary generated and translated by AI from the official description.
Certain instructions need intercepting and emulating by Xen. In some
cases Xen emulates the instruction by replaying it, using an executable
stub. Some instructions may raise an exception, which is supposed to be
handled gracefully. Certain replayed instructions have additional logic
to set up and recover the changes to the arithmetic flags.
For replayed instructions where the flags recovery logic is used, the
metadata for exception handling was incorrect, preventing Xen from
handling the the exception gracefully, treating it as fatal instead.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected products
Xen · Xen