Main Vulnerability Database Vulnerabilities #VU32222

Permissions, Privileges, and Access Controls in Xen - CVE-2016-9381

Published: January 23, 2017 / Updated: July 28, 2020

Vulnerability identifier: #VU32222

CSH Severity: Low

CVSS v4: 5 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]

CVE-ID: CVE-2016-9381

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to execute arbitrary code.

Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.

Affected software

Xen
xen (Alpine package)
xen
Fedora

How to mitigate CVE-2016-9381

Install update from vendor's website.

xen (Alpine package) - update to 4.6.3-r3
xen - addressed in versions 4.5.5-4.fc23, 4.6.4-2.fc24, 4.7.1-3.fc25

External References

http://www.securityfocus.com/bid/94476
http://www.securitytracker.com/id/1037344
http://xenbits.xen.org/xsa/advisory-197.html
https://security.gentoo.org/glsa/201612-56
https://support.citrix.com/article/CTX218775

Related Security Bulletins