High severity · published Jan 6, 2017
CVE-2016-9867
An issue was discovered in EMC ScaleIO versions before 2.0.1.1
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may be able to modify the kernel memory in the SCINI driver and may achieve code execution to escalate privileges to root on ScaleIO Data Client (SDC) servers.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Scaleio · Emc
through 2.0.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9867
Third Party Advisory
http://www.securityfocus.com/archive/1/539983/30/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/95300
More from Scaleio
9.8
CVE-2017-8020
An issue was discovered in EMC ScaleIO 2.0.1.x
7.5
CVE-2017-8019
An issue was discovered in EMC ScaleIO 2.0.1.x
5.5
CVE-2016-9869
An issue was discovered in EMC ScaleIO versions before 2.0.1.1
5.5
CVE-2016-9868
An issue was discovered in EMC ScaleIO versions before 2.0.1.1