PT-2017-10229 · Xen+2 · Xen+2

Published 2016-12-07 · Updated 2024-06-15 · CVE-2016-9637

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xen (affected versions not specified)

Description The issue involves the ioport read and ioport write functions in Xen when qemu is used as a device model. It might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-9637

DLA-1270-1

MGASA-2017-0012

OPENSUSE-SU-2016_3134-1

OPENSUSE-SU-2017_0007-1

OPENSUSE-SU-2017_0008-1

OPENSUSE-SU-2024:11520-1

RHSA-2016:2963

RHSA-2016_2963

SUSE-SU-2016:3044-1

SUSE-SU-2016:3067-1

SUSE-SU-2016:3083-1

SUSE-SU-2016:3156-1

SUSE-SU-2016:3174-1

SUSE-SU-2016:3273-1

Affected Products

Red Hat

Suse

Xen

References · 182

• https://osv.dev/vulnerability/openSUSE-SU-2024:11520-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9637 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:3067-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9637 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3273-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2963.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0012.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:3174-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9637 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0012 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3083-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9637 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9637 · Security Note
• https://ubuntu.com/security/CVE-2016-9637 · Vendor Advisory
• https://security.gentoo.org/glsa/201612-56 · Vendor Advisory