This article studies the reachable set of cyber-physical systems subject to stealthy attacks with the Kullback-Leibler divergence adopted to describe the stealthiness. The reachable set is defined as the set in which both the system state and the estimation error of the Kalman filter reside with a certain probability. The necessary and sufficient conditions of the reachable set being unbounded are given for the finite and infinite time cases, respectively. When the reachable set is bounded, an ellipsoidal outer approximation is obtained by solving a convex optimization problem. An application of this approximation to the safety evaluation is also given. A numerical simulation of an unmanned ground vehicle is presented to demonstrate the effectiveness of the proposed approach.