CVE-2016-7777

Severity: medium (CVSS 6.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-10-07 · updated 2026-06-17
Weakness: CWE-362

Description

Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.

Affected products

xen: through 4.7.0

References

http://www.securityfocus.com/bid/93344
http://www.securitytracker.com/id/1036942
http://xenbits.xen.org/xsa/advisory-190.html
https://security.gentoo.org/glsa/201611-09
https://support.citrix.com/article/CTX217363
http://www.securityfocus.com/bid/93344
http://www.securitytracker.com/id/1036942
http://xenbits.xen.org/xsa/advisory-190.html
https://security.gentoo.org/glsa/201611-09
https://support.citrix.com/article/CTX217363

Get alerted when CVE-2016-7777 or the next vulnerability affects your stack