CVE-2016-9386: High severity Citrix XenServer vulnerability
Published Jan 23, 2017
·Updated
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.
Affected Software
5 affected components
Citrix XenServer=6.0.2
Citrix XenServer=6.2.0
Citrix XenServer=6.5
Citrix XenServer=7.0
XEN Xen
Remediation
Patch Available
Patch Available
Event History
Jan 23, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-9386?
CVE-2016-9386 is classified as a high severity vulnerability due to potential privilege escalation risks.
2
How do I fix CVE-2016-9386?
To fix CVE-2016-9386, update your XenServer to the latest patched version as recommended by the vendor.
3
What versions of XenServer are affected by CVE-2016-9386?
CVE-2016-9386 affects XenServer versions 6.0.2, 6.2.0, 6.5, and 7.0.
4
Can local users exploit CVE-2016-9386?
Yes, local HVM guest users can exploit CVE-2016-9386 to gain elevated privileges.
5
Is there a workaround for CVE-2016-9386?
There are no known workarounds for CVE-2016-9386, and the recommended course of action is to apply the relevant security updates.