CVE-2016-9378: Medium severity XEN Xen vulnerability

Published Feb 22, 2017

Updated

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.

Affected Software

11 affected components

XEN Xen=4.5.0

XEN Xen=4.5.1

XEN Xen=4.5.2

XEN Xen=4.5.3

XEN Xen=4.5.5

XEN Xen=4.6.0

XEN Xen=4.6.1

XEN Xen=4.6.3

XEN Xen=4.6.4

XEN Xen=4.7.0

XEN Xen=4.7.1

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-196.html

Event History

Feb 22, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-9378?

CVE-2016-9378 has a medium severity rating as it can lead to a denial of service by crashing the guest OS.

How do I fix CVE-2016-9378?

To mitigate CVE-2016-9378, upgrade Xen to a version above 4.7.x or apply any patches provided by the maintainers.

What software versions are affected by CVE-2016-9378?

CVE-2016-9378 affects Xen versions 4.5.x through 4.7.x on AMD systems without the NRip feature.

Can CVE-2016-9378 lead to guest OS crashes?

Yes, CVE-2016-9378 allows local HVM guest OS users to crash the guest OS by exploiting the vulnerability.

Is CVE-2016-9378 specific to AMD hardware?

Yes, CVE-2016-9378 specifically impacts AMD systems running Xen without the NRip feature.