High severity · published Jan 23, 2017
CVE-2016-9386
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XE
Xen · Xen
All versions, or not specified · source: NVD
XE
Xenserver · Citrix
6.0.2; 6.2.0; 6.5; 7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9386
Third Party Advisory
http://www.securityfocus.com/bid/94471
Third Party Advisory
http://www.securitytracker.com/id/1037340
Patch
http://xenbits.xen.org/xsa/advisory-191.html
security.gentoo.org
https://security.gentoo.org/glsa/201612-56
Patch
https://support.citrix.com/article/CTX218775
More from Xenserver
9.9
CVE-2016-9603
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update…
9.9
CVE-2017-2620
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue
9.8
CVE-2018-14007
Citrix XenServer 7.1 and newer allows Directory Traversal
9.8
CVE-2015-7705
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests
9.8
CVE-2016-5302
Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management network to "compromise" a…