PT-2017-10095 · Amd+2 · Xen+2

Andrew Cooper · Published 2016-11-25 · Updated 2024-06-15 · CVE-2016-9377

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xen versions 4.5.x through 4.7.x

Description The issue allows local HVM guest OS users to cause a denial of service, resulting in a guest crash, by leveraging IDT entry miscalculation when emulating instructions that generate software interrupts on AMD systems without the NRip feature.

Recommendations For Xen versions 4.5.x through 4.7.x, consider disabling emulation of instructions that generate software interrupts as a temporary workaround until a patch is available. Restrict access to the IDT entry to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

DoS

Weakness Enumeration

CWE-682

Related Identifiers

ALT-PU-2016-2364

CVE-2016-9377

MGASA-2017-0012

OPENSUSE-SU-2016_3134-1

OPENSUSE-SU-2017_0007-1

OPENSUSE-SU-2024:11520-1

SUSE-SU-2016:3067-1

SUSE-SU-2016:3083-1

Affected Products

Alt Linux

Suse

Xen

References · 168

• https://nvd.nist.gov/vuln/detail/CVE-2016-9377 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11520-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9377 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3067-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9377 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9377 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9377 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0012.html · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0012 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3083-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2016-9377 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-196.html · Vendor Advisory
• https://security.gentoo.org/glsa/201612-56 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9377 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9377 · Vendor Advisory