CVE-2016-9381 : Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to ga

Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.

Published 2017-01-23 21:59:03

Updated 2020-10-23 16:29:17

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2016-9381

Citrix » Xenserver » Version: 6.2.0
cpe:2.3:a:citrix:xenserver:6.2.0:*:*:*:*:*:*:*
Matching versions
Citrix » Xenserver » Version: 6.0.2
cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*
Matching versions
Citrix » Xenserver » Version: 7.0
cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*
Matching versions
Citrix » Xenserver » Version: 6.5
cpe:2.3:a:citrix:xenserver:6.5:*:*:*:*:*:*:*
Matching versions
Qemu » Qemu
Versions up to, including, (<=) 2.7.1
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
Matching versions
Qemu » Qemu » Version: 2.8.0 Update RC0
cpe:2.3:a:qemu:qemu:2.8.0:rc0:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-9381

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 25 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-9381

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.5	HIGH	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	0.8	6.0	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-9381

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-9381

https://support.citrix.com/article/CTX218775

Citrix XenServer Multiple Security Updates
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/94476

Xen CVE-2016-9381 Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
http://xenbits.xen.org/xsa/advisory-197.html

XSA-197 - Xen Security Advisories
Third Party Advisory
https://security.gentoo.org/glsa/201612-56

Xen: Multiple vulnerabilities (GLSA 201612-56) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1037344

Xen QEMU Shared Ring Processing Flaw Lets Local Users on a Guest System Gain Elevated Privileges on the Host System - SecurityTracker
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2016-9381

Products affected by CVE-2016-9381

Exploit prediction scoring system (EPSS) score for CVE-2016-9381

CVSS scores for CVE-2016-9381

CWE ids for CVE-2016-9381

References for CVE-2016-9381