Vulnerability Details : CVE-2016-9383
Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.
Vulnerability category: Input validationExecute codeDenial of service
Products affected by CVE-2016-9383
- cpe:2.3:a:citrix:xenserver:6.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xenserver:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-9383
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 29 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-9383
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
2.0
|
6.0
|
NIST |
CWE ids for CVE-2016-9383
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-9383
-
https://support.citrix.com/article/CTX218775
Citrix XenServer Multiple Security UpdatesPatch;Third Party Advisory
-
http://www.securitytracker.com/id/1037346
Xen Register Operand Processing Error Lets Local Users on a Guest System Gain Elevated Privileges on the Host System - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/94474
Xen CVE-2016-9383 Memory Corruption VulnerabilityThird Party Advisory;VDB Entry
-
https://security.gentoo.org/glsa/201612-56
Xen: Multiple vulnerabilities (GLSA 201612-56) — Gentoo security
-
http://xenbits.xen.org/xsa/advisory-195.html
XSA-195 - Xen Security AdvisoriesPatch;Vendor Advisory
Jump to