Vulnerability in Citrix Xenserver
CVE-2016-9386
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.
EPSS: 0.001 (27.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Citrix Xenserver — versions 6.0.2, 6.2.0, 6.5
- Xen
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (vendor-advisory, x_refsource_GENTOO)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2016-9386?
- CVE-2016-9386 is a high-severity vulnerability in Citrix Xenserver, classified under CWE-264. CVSS score: 7.8/10. Published 2017-01-23.
- How severe is CVE-2016-9386?
- High severity. CVSS v3 base score is 7.8 out of 10.