CVE-2016-9379: Input Validation
The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9379?
CVE-2016-9379 is classified as a high severity vulnerability due to its potential to allow local guest OS administrators to gain unauthorized access to host files.
How do I fix CVE-2016-9379?
To remediate CVE-2016-9379, update your Xen or XenServer installation to the latest patched version provided by the vendor.
Who is affected by CVE-2016-9379?
CVE-2016-9379 affects installations of Xen and specific versions of Citrix XenServer including 6.0.2, 6.2.0, 6.5, and 7.0.
What types of attacks can be executed using CVE-2016-9379?
CVE-2016-9379 can be exploited to read or delete arbitrary files on the host system by manipulating the bootloader configuration.
When was CVE-2016-9379 disclosed?
CVE-2016-9379 was disclosed in November 2016, highlighting the security risk associated with the pygrub boot loader.