{"api_version":"1","generated_at":"2026-07-23T01:53:24+00:00","cve":"CVE-2016-9386","urls":{"html":"https://cve.report/CVE-2016-9386","api":"https://cve.report/api/cve/CVE-2016-9386.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-9386","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-9386"},"summary":{"title":"CVE-2016-9386","description":"The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving \"unexpected\" base/limit values.","state":"PUBLISHED","assigner":"mitre","published_at":"2017-01-23 21:59:02","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.6","severity":"","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","baseScore":4.6,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://security.gentoo.org/glsa/201612-56","name":"https://security.gentoo.org/glsa/201612-56","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Xen: Multiple vulnerabilities (GLSA 201612-56) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1037340","name":"http://www.securitytracker.com/id/1037340","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Xen x86 Null Segment Access Control Bug Lets Local Users on a Guest System Gain Elevated Privileges on the Guest System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.citrix.com/article/CTX218775","name":"https://support.citrix.com/article/CTX218775","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"title":"Citrix XenServer Multiple Security Updates","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://xenbits.xen.org/xsa/advisory-191.html","name":"http://xenbits.xen.org/xsa/advisory-191.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"XSA-191 - Xen Security Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/94471","name":"http://www.securityfocus.com/bid/94471","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Xen CVE-2016-9386 Privilege Escalation Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9386","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9386","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"9386","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"xenserver","cpe6":"6.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"9386","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"xenserver","cpe6":"6.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"9386","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"xenserver","cpe6":"6.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"9386","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"xenserver","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"9386","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"xen","cpe5":"xen","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2016-9386","qid":"500810","title":"Alpine Linux Security Update for xen"},{"cve":"CVE-2016-9386","qid":"504553","title":"Alpine Linux Security Update for xen"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T02:50:37.602Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"94471","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/94471"},{"name":"GLSA-201612-56","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201612-56"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.citrix.com/article/CTX218775"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://xenbits.xen.org/xsa/advisory-191.html"},{"name":"1037340","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1037340"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-11-22T00:00:00.000Z","descriptions":[{"lang":"en","value":"The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving \"unexpected\" base/limit values."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-06-30T16:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"94471","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/94471"},{"name":"GLSA-201612-56","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201612-56"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.citrix.com/article/CTX218775"},{"tags":["x_refsource_CONFIRM"],"url":"http://xenbits.xen.org/xsa/advisory-191.html"},{"name":"1037340","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1037340"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2016-9386","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving \"unexpected\" base/limit values."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"94471","refsource":"BID","url":"http://www.securityfocus.com/bid/94471"},{"name":"GLSA-201612-56","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201612-56"},{"name":"https://support.citrix.com/article/CTX218775","refsource":"CONFIRM","url":"https://support.citrix.com/article/CTX218775"},{"name":"http://xenbits.xen.org/xsa/advisory-191.html","refsource":"CONFIRM","url":"http://xenbits.xen.org/xsa/advisory-191.html"},{"name":"1037340","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1037340"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2016-9386","datePublished":"2017-01-23T21:00:00.000Z","dateReserved":"2016-11-17T00:00:00.000Z","dateUpdated":"2024-08-06T02:50:37.602Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-01-23 21:59:02","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","baseScore":4.6,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:xenserver:6.0.2:*:*:*:*:*:*:*","matchCriteriaId":"5FCF191B-971A-4945-AB14-08091689BE2F"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:xenserver:6.2.0:*:*:*:*:*:*:*","matchCriteriaId":"BCEA97B9-A443-4F87-81B4-B3F0E94AC18E"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:xenserver:6.5:*:*:*:*:*:*:*","matchCriteriaId":"56434D13-7A7B-495C-A135-2688C706A065"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:xenserver:7.0:*:*:*:*:*:*:*","matchCriteriaId":"405F950F-0772-41A3-8B72-B67151CC1376"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*","matchCriteriaId":"C2B9CCC2-BAC5-4A65-B8D4-4B71EBBA0C2F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"9386","Ordinal":"1","Title":"CVE-2016-9386","CVE":"CVE-2016-9386","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"9386","Ordinal":"1","NoteData":"The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving \"unexpected\" base/limit values.","Type":"Description","Title":"CVE-2016-9386"},{"CveYear":"2016","CveId":"9386","Ordinal":"2","NoteData":"2017-01-23","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"9386","Ordinal":"3","NoteData":"2017-06-30","Type":"Other","Title":"Modified"}]}}}