CVE-2016-9637 Privilege escalation in n/a

High 7.5 Published 16 Feb 2017 Updated 6 Aug 2024

Local guest administrators can escalate privileges to the qemu process via out-of-range ioport access in Xen with qemu device model.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2016-9637?

CVE-2016-9637 is a high-severity vulnerability in Citrix Xenserver, published on 16 Feb 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.

Weakness: CWE-264

Which versions are affected by CVE-2016-9637?

It affects 1 product.

Linux distribution packages (12)

`xen` Red Hat:enterprise_linux:5::client	All versions	`0:3.0.3-148.el5_11`
`xen-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:3.0.3-148.el5_11`
`xen-libs` Red Hat:enterprise_linux:5::client	All versions	`0:3.0.3-148.el5_11`
`xen` Red Hat:enterprise_linux:5::server	All versions	`0:3.0.3-148.el5_11`
`xen-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:3.0.3-148.el5_11`
`xen-libs` Red Hat:enterprise_linux:5::server	All versions	`0:3.0.3-148.el5_11`
`xen` Red Hat:rhel_virtualization:5::client	All versions	`0:3.0.3-148.el5_11`
`xen-debuginfo` Red Hat:rhel_virtualization:5::client	All versions	`0:3.0.3-148.el5_11`
`xen-devel` Red Hat:rhel_virtualization:5::client	All versions	`0:3.0.3-148.el5_11`
`xen` Red Hat:rhel_virtualization:5::server	All versions	`0:3.0.3-148.el5_11`
`xen-debuginfo` Red Hat:rhel_virtualization:5::server	All versions	`0:3.0.3-148.el5_11`
`xen-devel` Red Hat:rhel_virtualization:5::server	All versions	`0:3.0.3-148.el5_11`

Products include Citrix Xenserver.

How do I fix CVE-2016-9637?

Apply the vendor's patch.

Is CVE-2016-9637 being exploited?

There is no known exploitation of CVE-2016-9637 in the wild and no public exploit code.

All Citrix Xenserver vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-9637, GHSA-5m8h-4qv2-6hhp, RHSA-2016:2963, UBUNTU-CVE-2016-9637.