← Back

CVE-2016-9381

nvd nist
Published: Jan 23, 2017Modified: May 13, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploitability: 0.8 / Impact: 6.0
Source: NVD

Description

Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.

Affected (6)

Products: Qemu: Qemu · Citrix: Xenserver
Qemu
1 product
Qemu
Citrix
1 product
Xenserver
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Qemu
Qemu
Up to 2.7.1
Qemu
Version 2.8.0 rc0
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Citrix
Xenserver
Version 6.0.2
Xenserver
Version 6.2.0
Xenserver
Version 6.5
Xenserver
Version 7.0

Related CWEs

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (10)

Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.