{"id":"CVE-2016-9381","aliases":["ALPINE-CVE-2016-9381","DEBIAN-CVE-2016-9381","DLA-720-1","EUVD-2016-10191","GHSA-fg67-6qhp-f8mj","MGASA-2017-0012","SUSE-SU-2016:3044-1","SUSE-SU-2016:3067-1","SUSE-SU-2016:3083-1","SUSE-SU-2016:3156-1","SUSE-SU-2016:3174-1","SUSE-SU-2016:3273-1","SUSE-SU-2017:0127-1","UBUNTU-CVE-2016-9381","USN-3261-1","openSUSE-SU-2024:11520-1"],"status":"published","title":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by...","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00292,"percentile":0.21948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2016-11-24T00:00:00Z","modified":"2026-10-24T10:30:38Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"xen","fixed_in":["4.7.1-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.33"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xen","fixed_in":["4.4.2-0ubuntu0.14.04.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"qemu","fixed_in":["1:2.5+dfsg-5ubuntu10.11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6.lts1-4"}]}],"versions":["4.1.4-3","4.1.4-3+deb7u1","4.1.4-3+deb7u2","4.1.4-3+deb7u3","4.1.4-3+deb7u4","4.1.4-3+deb7u5","4.1.4-3+deb7u6","4.1.4-3+deb7u7","4.1.4-3+deb7u8","4.1.4-3+deb7u9","4.1.4-4","4.1.6.1-1+deb7u1","4.1.6.lts1-1","4.1.6.lts1-2","4.1.6.lts1-3"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1.1.mga5"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6_08-32.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1_02-25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1_02-25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1_02-25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1_02-25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5_02-22.3.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5_02-22.3.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5_02-22.3.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5_02-22.3.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_05-22.25.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_05-22.25.1"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_10-43.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_10-43.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_10-43.5"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-30.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-30.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-30.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-30.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-30.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-39.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-39.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-39.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-39.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.33"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-0ubuntu0.14.04.9"}]}],"versions":["4.3.0-1ubuntu1","4.3.0-1ubuntu2","4.3.0-1ubuntu3","4.3.0-1ubuntu4","4.3.0-1ubuntu5","4.4.0-0ubuntu3","4.4.0-0ubuntu4","4.4.0-0ubuntu5","4.4.0-0ubuntu5.1","4.4.0-0ubuntu5.2","4.4.1-0ubuntu0.14.04.1","4.4.1-0ubuntu0.14.04.2","4.4.1-0ubuntu0.14.04.3","4.4.1-0ubuntu0.14.04.4","4.4.1-0ubuntu0.14.04.5","4.4.1-0ubuntu0.14.04.6","4.4.2-0ubuntu0.14.04.1","4.4.2-0ubuntu0.14.04.2","4.4.2-0ubuntu0.14.04.3","4.4.2-0ubuntu0.14.04.4","4.4.2-0ubuntu0.14.04.5","4.4.2-0ubuntu0.14.04.6","4.4.2-0ubuntu0.14.04.7"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.11"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.33"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32"],"bundled":37},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.11"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10"],"bundled":37},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.1_01-1.2"}]}],"bundled":93}],"products":[{"vendor":"citrix","product":"xenserver"},{"vendor":"qemu","product":"qemu"}],"references":[{"url":"http://xenbits.xen.org/xsa/advisory-197.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201612-56","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/94476","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://support.citrix.com/article/CTX218775","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1037344","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9381"},{"url":"https://github.com/advisories/GHSA-fg67-6qhp-f8mj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9381","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9381","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0012.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19901","tags":["report"]},{"url":"https://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-453.html","tags":["web"]},{"url":"https://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-455.html","tags":["web"]},{"url":"https://xenbits.xen.org/xsa/advisory-172.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-173.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-175.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-176.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-178.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-179.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-180.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-181.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-182.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-183.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-184.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-185.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-186.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-187.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-190.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-191.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-192.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-193.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-194.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-195.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-196.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-197.html","tags":["advisory","report"]},{"url":"https://xenbits.xen.org/xsa/advisory-198.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-199.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-200.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-202.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-204.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163044-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000106","tags":["report"]},{"url":"https://bugzilla.suse.com/1000893","tags":["report"]},{"url":"https://bugzilla.suse.com/1003030","tags":["report"]},{"url":"https://bugzilla.suse.com/1003032","tags":["report"]},{"url":"https://bugzilla.suse.com/1005004","tags":["report"]},{"url":"https://bugzilla.suse.com/1005005","tags":["report"]},{"url":"https://bugzilla.suse.com/1007157","tags":["report"]},{"url":"https://bugzilla.suse.com/1009100","tags":["report"]},{"url":"https://bugzilla.suse.com/1009103","tags":["report"]},{"url":"https://bugzilla.suse.com/1009107","tags":["report"]},{"url":"https://bugzilla.suse.com/1009109","tags":["report"]},{"url":"https://bugzilla.suse.com/1009111","tags":["report"]},{"url":"https://bugzilla.suse.com/1011652","tags":["report"]},{"url":"https://bugzilla.suse.com/990843","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9637","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163067-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1004981","tags":["report"]},{"url":"https://bugzilla.suse.com/1007941","tags":["report"]},{"url":"https://bugzilla.suse.com/1009104","tags":["report"]},{"url":"https://bugzilla.suse.com/1009105","tags":["report"]},{"url":"https://bugzilla.suse.com/1009108","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9385","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163083-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1003870","tags":["report"]},{"url":"https://bugzilla.suse.com/1004016","tags":["report"]},{"url":"https://bugzilla.suse.com/1007160","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8909","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163156-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/953518","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163174-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163273-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170127-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007454","tags":["report"]},{"url":"https://bugzilla.suse.com/1008519","tags":["report"]},{"url":"https://bugzilla.suse.com/1013285","tags":["report"]},{"url":"https://bugzilla.suse.com/1013341","tags":["report"]},{"url":"https://bugzilla.suse.com/1013764","tags":["report"]},{"url":"https://bugzilla.suse.com/1013767","tags":["report"]},{"url":"https://bugzilla.suse.com/1014109","tags":["report"]},{"url":"https://bugzilla.suse.com/1014110","tags":["report"]},{"url":"https://bugzilla.suse.com/1014111","tags":["report"]},{"url":"https://bugzilla.suse.com/1014112","tags":["report"]},{"url":"https://bugzilla.suse.com/1014256","tags":["report"]},{"url":"https://bugzilla.suse.com/1014514","tags":["report"]},{"url":"https://bugzilla.suse.com/1016779","tags":["report"]},{"url":"https://bugzilla.suse.com/937125","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9922","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-9381","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3261-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9381","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5525","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6505","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28687","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9381","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","status":"published","published":"2017-01-23T21:00:00Z","modified":"2024-08-06T02:50:37.693Z","updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-10191","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","status":"published","published":"2017-01-23T21:00:00Z","modified":"2024-08-06T02:50:37Z","updated_at":"2026-11-03T02:22:27.235814Z"}],"ghsa":[{"id":"GHSA-fg67-6qhp-f8mj","title":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by...","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","status":"published","published":"2022-05-13T01:14:07Z","modified":"2023-02-01T05:04:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:50:08.411477Z"}],"nvd":[{"id":"CVE-2016-9381","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","status":"published","published":"2017-01-23T21:59:02.8Z","modified":"2026-06-17T00:55:55.417Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"ALPINE-CVE-2016-9381","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","status":"published","published":"2017-01-23T21:59:02.8Z","modified":"2026-09-22T06:17:50.250623058Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2016-9381","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","status":"published","published":"2017-01-23T21:59:02.8Z","modified":"2026-10-24T10:30:38.468651559Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-9381","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","status":"published","published":"2017-01-23T21:59:02.8Z","modified":"2026-09-22T07:00:12.659578598Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2016-9381","description":"Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a \"double fetch\" vulnerability.","status":"published","published":"2017-01-23T00:00:00Z","modified":"2026-04-22T11:04:03.86509Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DLA-720-1","title":"xen - security update","status":"published","published":"2016-11-24T00:00:00Z","modified":"2026-03-09T02:09:09.798175Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2017-0012","title":"Updated xen packages fix security vulnerability","description":"This xen update is based on upstream 4.5.5 maintenance release, and fixes\nthe following security issues:\n\nThe qemu implementation in libvirt before 1.3.0 and Xen allows local guest\nOS users to cause a denial of service (host disk consumption) by writing\nto stdout or stderr (CVE-2014-3672)\n\nThe xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle\nwrites to the hardware FSW.ES bit when running on AMD64 processors, which\nallows local guest OS users to obtain sensitive register content information\nfrom another guest by leveraging pending exception and mask bits. NOTE: this\nvulnerability exists because of an incorrect fix for CVE-2013-2076\n(CVE-2016-3158).\n\nThe fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly\nhandle writes to the hardware FSW.ES bit when running on AMD64 processors,\nwhich allows local guest OS users to obtain sensitive register content\ninformation from another guest by leveraging pending exception and mask\nbits. NOTE: this vulnerability exists because of an incorrect fix for\nCVE-2013-2076 (CVE-2016-3159).\n\nThe VGA module in QEMU improperly performs bounds checking on banked access\nto video memory, which allows local guest OS administrators to execute\narbitrary code on the host by changing access modes after setting the bank\nregister, aka the \"Dark Portal\" issue (CVE-2016-3710).\n\nInteger overflow in the VGA module in QEMU allows local guest OS users to\ncause a denial of service (out-of-bounds read and QEMU process crash) by\nediting VGA registers in VBE mode (CVE-2016-3712).\n\nInteger overflow in the x86 shadow pagetable code in Xen allows local guest\nOS users to cause a denial of service (host crash) or possibly gain\nprivileges by shadowing a superpage mapping (CVE-2016-3960).\n\nThe libxl device-handling in Xen 4.6.x and earlier allows local OS guest\nadministrators to cause a denial of service (resource consumption or\nmanagement facility confusion) or gain host OS privileges by manipulating\ninformation in guest controlled areas of xenstore (CVE-2016-4962).\n\nThe libxl device-handling in Xen through 4.6.x allows local guest OS users\nwith access to the driver domain to cause a denial of service (management\ntool confusion) by manipulating information in the backend directories in\nxenstore (CVE-2016-4963).\n\nThe guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and\nearlier does not properly handle the Page Size (PS) page table entry bit at\nthe L4 and L3 page table levels, which might allow local guest OS users to\ngain privileges via a crafted mapping of memory (CVE-2016-4480).\n\nThe p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows\nlocal guest OS users with access to the driver domain to cause a denial of\nservice (NULL pointer dereference and host OS crash) by creating concurrent\ndomains and holding references to them, related to VMID exhaustion\n(CVE-2016-5242).\n\nThe virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest\nOS administrators to cause a denial of service (memory consumption and QEMU\nprocess crash) by submitting requests without waiting for completion\n(CVE-2016-5403).\n\nThe PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local\n32-bit PV guest OS administrators to gain host OS privileges by leveraging\nfast-paths for updating pagetable entries (CVE-2016-6258).\n\nXen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention\n(SMAP) whitelisting in 32-bit exception and event delivery, which allows\nlocal 32-bit PV guest OS kernels to cause a denial of service (hypervisor\nand VM crash) by triggering a safety check (CVE-2016-6259).\n\nThe get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit\nPV guest OS administrators to gain host OS privileges via vectors related\nto L3 recursive pagetables (CVE-2016-7092).\n\nXen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to\noverwrite hypervisor memory and consequently gain host OS privileges by\nleveraging mishandling of instruction pointer truncation during emulation\n(CVE-2016-7093).\n\nBuffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS\nadministrators on guests running with shadow paging to cause a denial of\nservice via a pagetable update (CVE-2016-7094).\n\nXen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which\nallows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM\nregister state information belonging to arbitrary tasks on the guest by\nmodifying an instruction while the hypervisor is preparing to emulate it\n(CVE-2016-7777).\n\nWhen Xen emulates instructions which generate software interrupts it needs\nto perform a privilege check involving an IDT lookup. This check is sometimes\nerroneously conducted as if the IDT had the format for a 32-bit guest, when\nin fact it is in the 64-bit format. Xen will then read the wrong part of the\nIDT and interpret it in an unintended manner. An unprivileged guest user\nprogram may be able to crash the guest (CVE-2016-9377).\n\nWhen Xen emulates instructions which generate software interrupts, and\nchooses to deliver the software interrupt, it may try to use the method\nintended for injecting exceptions. This is incorrect, and results in a\nguest crash (CVE-2016-9378).\n\npygrub supports a number of output formats. When the S-expression output\nformat is requested, putting string quotes and S-expressions in the \nbootloader configuration file can produce incorrect output. A malicious\nguest administrator can obtain the contents of sensitive host files (an\ninformation leak), or can cause files on the host to be removed, causing\na denial of service or in unusual cases privilegie escalation (CVE-2016-9379).\n\nWhen the nul-delimited output format is requested, nul bytes in the\nbootloader configuration file can produce an ambiguous or confusing output\nfile, which is interpreted by libxl in a vulnerable way. A malicious guest\nadministrator can obtain the contents of sensitive host files (an information\nleak), or can cause files on the host to be removed, causing a denial of\nservice or in unusual cases privilegie escalation (CVE-2016-9380).\n\nThe compiler can emit optimizations in qemu which can lead to double fetch\nvulnerabilities. Specifically data on the rings shared between qemu and the\nhypervisor (which the guest under control can obtain mappings of) can be\nfetched twice (during which time the guest can alter the contents) possibly\nleading to arbitrary code execution in qemu. Malicious administrators can\nexploit this vulnerability to take over the qemu process, elevating its\nprivilege to that of the qemu process. In a system not using a device model\nstub domain (or other techniques for deprivileging qemu), malicious guest\nadministrators can thus elevate their privilege to that of the host\n(CVE-2016-9381).\n\nLDTR, just like TR, is purely a protected mode facility. Hence even when\nswitching to a VM86 mode task, LDTR loading needs to follow protected mode\nsemantics. This was violated by the code. On SVM (AMD hardware): a malicious\nunprivileged guest process can escalate its privilege to that of the guest\noperating system. On both SVM and VMX (Intel hardware): a malicious\nunprivileged guest process can crash the guest (CVE-2016-9382).\n\nThe x86 instructions BT, BTC, BTR, and BTS, when used with a destination\nmemory operand and a source register rather than an immediate operand,\naccess a memory location offset from that specified by the memory operand\nas specified by the high bits of the register source. When Xen needs to\nemulate such an instruction, to efficiently handle the emulation, the memory\naddress and register operand are recalculated internally to Xen. In this\nprocess, the high bits of an intermediate expression were discarded, leading\nto both the memory location and the register operand being wrong. A malicious\nguest can modify arbitrary memory, allowing for arbitrary code execution\n(and therefore privilege escalation affecting the whole host), a crash of\nthe host (leading to a DoS), or information leaks (CVE-2016-9383).\n\nAlong with their main kernel binary, unprivileged guests may arrange to \nhave their Xen environment load (kernel) symbol tables for their use.\nThe ELF image metadata created for this purpose has a few unused bytes\nwhen the symbol table binary is in 32-bit ELF format. These unused bytes\nwere not properly cleared during symbol table loading. A malicious\nunprivileged guest may be able to obtain sensitive information from the\nhost (CVE-2016-9384).\n\nBoth writes to the FS and GS register base MSRs as well as the WRFSBASE and\nWRGSBASE instructions require their input values to be canonical, or a #GP\nfault will be raised. When the use of those instructions by the hypervisor\nwas enabled, the previous guard against #GP faults (having recovery code\nattached) was accidentally removed. A malicious guest administrator can\ncrash the host, leading to a DoS (CVE-2016-9385).\n\nThe Xen x86 emulator erroneously failed to consider the unusability of\nsegments when performing memory accesses. An unprivileged guest user\nprogram may be able to elevate its privilege to that of the guest operating\nsystem (CVE-2016-9386).\n\nThe code in qemu which implements ioport read/write looks up the specified\nioport address in a 32-bit dispatch table without proper range checks.\nXen will write only 16-bit address ioport accesses. However, depending on\nthe Xen and qemu version, the ring may be writeable by the guest. If so,\nthe guest can generate out-of-range ioport accesses, resulting in wild\npointer accesses within qemu. A malicious guest administrator can escalate\ntheir privilege to that of the host (CVE-2016-9637).\n\nx86 CMPXCHG8B emulation fails to ignore operand size override. A malicious\nunprivileged guest may be able to obtain sensitive information from the\nhost (CVE-2016-9932).\n\nx86 PV guests may be able to mask interrupts. A malicious guest kernel\nadministrator can cause a host hang or crash, resulting in a Denial of\nService (CVE-2016-10024).\n\nx86: Mishandling of SYSCALL singlestep during emulation. Guest userspace\nwhich can invoke the instruction emulator can use this flaw to escalate\nits privilege to that of the guest kernel (CVE-2016-10013).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-01-09T20:29:57Z","modified":"2026-04-16T06:26:07.137305065Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11520-1","title":"xen-4.15.1_01-1.2 on GA media","description":"These are all security issues fixed in the xen-4.15.1_01-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:22.378535Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2016:3044-1","title":"Security update for xen","description":"\nxen was updated to fix several security issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652).\n- CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100)\n- CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103)\n- CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107)\n- CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109)\n- CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed  guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106)\n- CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157)\n- CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004)\n- CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005)\n- CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030)\n- CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032)\n- CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c, when built with ESP/NCR53C9x controller emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the host via vectors involving DMA read into ESP command buffer (bsc#990843)\n\nThis non-security issue was fixed:\n\n- bsc#1000893: virsh setmem didn't allow to set current guest memory to max limit\n","status":"published","published":"2016-12-07T15:44:40Z","modified":"2026-02-04T04:40:18.728856Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3067-1","title":"Security update for xen","description":"\nxen was updated to version 4.7.1 to fix 17 security issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652).\n- CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100).\n- CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103).\n- CVE-2016-9385: x86 segment base write emulation lacked canonical address checks, allowing a malicious guest administrator to crash the host (bsc#1009104).\n- CVE-2016-9384: Guest 32-bit ELF symbol table load leaking host data to unprivileged guest users (bsc#1009105).\n- CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107).\n- CVE-2016-9377: x86 software interrupt injection was mis-handled, allowing an unprivileged guest user to crash the guest (bsc#1009108).\n- CVE-2016-9378: x86 software interrupt injection was mis-handled, allowing an unprivileged guest user to crash the guest (bsc#1009108)\n- CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109).\n- CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111).\n- CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed  guest administrators to obtain the contents of sensitive host files or delete the files  (bsc#1009111).\n- CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106).\n- CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157).\n- CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004).\n- CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005).\n- CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030).\n- CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032).\n\nThese non-security issues were fixed:\n\n- bsc#1004981: Xen RPM didn't contain debug hypervisor for EFI systems\n- bsc#1007941: Xen tools limited the number of vcpus to 256 \n","status":"published","published":"2016-12-09T13:13:04Z","modified":"2026-02-04T04:08:10.612078Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3083-1","title":"Security update for xen","description":"\nThis update for xen to version 4.5.5 fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652)\n- CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100)\n- CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103)\n- CVE-2016-9385: x86 segment base write emulation lacked canonical address checks, allowing a malicious guest administrator to crash the host (bsc#1009104)\n- CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107)\n- CVE-2016-9378: x86 software interrupt injection was mis-handled, allowing an unprivileged guest user to crash the guest (bsc#1009108)\n- CVE-2016-9377: x86 software interrupt injection was mis-handled, allowing an unprivileged guest user to crash the guest (bsc#1009108)\n- CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109)\n- CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed  guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106)\n- CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157)\n- CVE-2016-8909: The intel_hda_xfer function in hw/audio/intel-hda.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position (bsc#1007160).\n- CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004)\n- CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005)\n- CVE-2016-7995: A memory leak in ehci_process_itd allowed a privileged user inside guest to DoS the host (bsc#1003870).\n- CVE-2016-8576: The xhci_ring_fetch function in hw/usb/hcd-xhci.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process (bsc#1004016).\n- CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030)\n- CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032)\n","status":"published","published":"2016-12-12T08:36:28Z","modified":"2025-05-02T04:05:32.609498Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3156-1","title":"Security update for xen","description":"\nThis update for xen fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652)\n- CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100)\n- CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103)\n- CVE-2016-9385: x86 segment base write emulation lacked canonical address checks, allowing a malicious guest administrator to crash the host (bsc#1009104)\n- CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107)\n- CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109)\n- CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed  guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106)\n- CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157)\n- CVE-2016-8909: The intel_hda_xfer function in hw/audio/intel-hda.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position (bsc#1007160)\n- CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004)\n- CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005)\n- CVE-2016-8576: The xhci_ring_fetch function in hw/usb/hcd-xhci.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process (bsc#1004016)\n- CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030)\n- CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032)\n\nThese non-security issues were fixed:\n\n- bsc#953518: Unplug also SCSI disks in qemu-xen-traditional for upstream unplug protocol\n- bsc#953518: Unplug also SCSI disks in qemu-xen\n","status":"published","published":"2016-12-14T13:56:32Z","modified":"2026-02-04T02:50:07.587423Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3174-1","title":"Security update for xen","description":"\nThis update for xen fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652)\n- CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100)\n- CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103)\n- CVE-2016-9385: x86 segment base write emulation lacked canonical address checks, allowing a malicious guest administrator to crash the host (bsc#1009104)\n- CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107)\n- CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109)\n- CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed  guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106)\n- CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157)\n- CVE-2016-8909: The intel_hda_xfer function in hw/audio/intel-hda.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position (bsc#1007160)\n- CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004)\n- CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005)\n- CVE-2016-8576: The xhci_ring_fetch function in hw/usb/hcd-xhci.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process (bsc#1004016)\n- CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030)\n- CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032)\n\nThis non-security issue wasfixed:\n- bsc#1000893: virsh setmem didn't allow to set current guest memory to max limit\n\nThis update also delivers man-pages-supplement since some of the man-pages in there\nare now contained in the xen package itself.\n","status":"published","published":"2016-12-16T12:01:04Z","modified":"2026-02-04T04:03:00.667894Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2016:3273-1","title":"Security update for xen","description":"\nThis update for xen fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9637: ioport array overflow allowing a malicious guest administrator can escalate their privilege to that of the host (bsc#1011652)\n- CVE-2016-9386: x86 null segments were not always treated as unusable allowing an unprivileged guest user program to elevate its privilege to that of the guest operating system. Exploit of this vulnerability is easy on Intel and more complicated on AMD (bsc#1009100)\n- CVE-2016-9382: x86 task switch to VM86 mode was mis-handled, allowing a unprivileged guest process to escalate its privilege to that of the guest operating system on AMD hardware. On Intel hardware a malicious unprivileged guest process can crash the guest (bsc#1009103)\n- CVE-2016-9383: The x86 64-bit bit test instruction emulation was broken, allowing a guest to modify arbitrary memory leading to arbitray code execution (bsc#1009107)\n- CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109)\n- CVE-2016-9380: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-9379: Delimiter injection vulnerabilities in pygrub allowed guest administrators to obtain the contents of sensitive host files or delete the files (bsc#1009111)\n- CVE-2016-7777: Xen did not properly honor CR0.TS and CR0.EM, which allowed local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it (bsc#1000106)\n- CVE-2016-8910: The rtl8139_cplus_transmit function in hw/net/rtl8139.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count (bsc#1007157)\n- CVE-2016-8909: The intel_hda_xfer function in hw/audio/intel-hda.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position (bsc#1007160)\n- CVE-2016-8667: The rc4030_write function in hw/dma/rc4030.c in allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via a large interval timer reload value (bsc#1005004)\n- CVE-2016-8669: The serial_update_parameters function in hw/char/serial.c allowed local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base (bsc#1005005)\n- CVE-2016-7908: The mcf_fec_do_tx function in hw/net/mcf_fec.c did not properly limit the buffer descriptor count when transmitting packets, which allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags (bsc#1003030)\n- CVE-2016-7909: The pcnet_rdra_addr function in hw/net/pcnet.c allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0 (bsc#1003032)\n\nThis non-security issue was fixed:\n\n- bsc#1000893: virsh setmem didn't allow to set current guest memory to max limit\n","status":"published","published":"2016-12-27T12:30:30Z","modified":"2026-02-04T02:38:02.879366Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0127-1","title":"Security update for qemu","description":"\nqemu was updated to fix several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-9102: Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number (bsc#1014256).\n- CVE-2016-9103: The v9fs_xattrcreate function in hw/9pfs/9p.c in allowed local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values writing to them (bsc#1007454).\n- CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109)\n- CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285).\n- CVE-2016-9845: The Virtio GPU Device emulator support as vulnerable to an information leakage issue while processing the 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could have used this flaw to leak contents of the host memory (bsc#1013767).\n- CVE-2016-9846: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue while updating the cursor data in update_cursor_data_virgl. A guest user/process could have used this flaw to leak host memory bytes, resulting in DoS for the host (bsc#1013764).\n- CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'.  A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109).\n- CVE-2016-9908: The Virtio GPU Device emulator support was vulnerable to an information leakage issue while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could have used this flaw to leak contents of the host memory (bsc#1014514).\n- CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111).\n- CVE-2016-9912: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could have used this flaw to leak host memory bytes, resulting in DoS for the host (bsc#1014112).\n- CVE-2016-9913: VirtFS was vulnerable to memory leakage issue via its '9p-handle' or '9p-proxy' backend drivers. A privileged user inside guest could have used this flaw to leak host memory, thus affecting other services on the host and/or potentially crash the Qemu process on the host (bsc#1014110).\n\nThese non-security issues were fixed:\n\n- Fixed uint64 property parsing and add regression tests (bsc#937125)\n- Added a man page for kvm_stat\n- Fix crash in vte (bsc#1008519)\n- Various upstream commits targeted towards stable releases (bsc#1013341)\n","status":"published","published":"2017-01-13T15:30:43Z","modified":"2026-02-04T04:31:19.819738Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3261-1","title":"qemu vulnerabilities","description":"Zhenhao Hong discovered that QEMU incorrectly handled the Virtio GPU\ndevice. An attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n16.04 LTS and Ubuntu 16.10. (CVE-2016-10028, CVE-2016-10029)\n\nLi Qiang discovered that QEMU incorrectly handled the 6300esb watchdog. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2016-10155)\n\nLi Qiang discovered that QEMU incorrectly handled the i.MX Fast Ethernet\nController. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service. This issue only\naffected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7907)\n\nIt was discovered that QEMU incorrectly handled the JAZZ RC4030 device. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2016-8667)\n\nIt was discovered that QEMU incorrectly handled the 16550A UART device. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2016-8669)\n\nIt was discovered that QEMU incorrectly handled the shared rings when used\nwith Xen. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code on the host. (CVE-2016-9381)\n\nJann Horn discovered that QEMU incorrectly handled VirtFS directory\nsharing. A privileged attacker inside the guest could use this issue to\naccess files on the host file system outside of the shared directory and\npossibly escalate their privileges. In the default installation, when QEMU\nis used with libvirt, attackers would be isolated by the libvirt AppArmor\nprofile. (CVE-2016-9602)\n\nGerd Hoffmann discovered that QEMU incorrectly handled the Cirrus VGA\ndevice when being used with a VNC connection. A privileged attacker inside\nthe guest could use this issue to cause QEMU to crash, resulting in a\ndenial of service, or possibly execute arbitrary code on the host. In the\ndefault installation, when QEMU is used with libvirt, attackers would be\nisolated by the libvirt AppArmor profile. (CVE-2016-9603)\n\nIt was discovered that QEMU incorrectly handled the ColdFire Fast Ethernet\nController. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service. (CVE-2016-9776)\n\nLi Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An\nattacker inside the guest could use this issue to cause QEMU to leak\ncontents of host memory. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 16.10. (CVE-2016-9845, CVE-2016-9908)\n\nLi Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 16.10. (CVE-2016-9846, CVE-2016-9912, CVE-2017-5552,\nCVE-2017-5578, CVE-2017-5857)\n\nLi Qiang discovered that QEMU incorrectly handled the USB redirector. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 16.10. (CVE-2016-9907)\n\nLi Qiang discovered that QEMU incorrectly handled USB EHCI emulation. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2016-9911)\n\nLi Qiang discovered that QEMU incorrectly handled VirtFS directory sharing.\nA privileged attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2016-9913, CVE-2016-9914,\nCVE-2016-9915, CVE-2016-9916)\n\nQinghao Tang, Li Qiang, and Jiangxin discovered that QEMU incorrectly\nhandled the Cirrus VGA device. A privileged attacker inside the guest could\nuse this issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2016-9921, CVE-2016-9922)\n\nWjjzhang and Li Qiang discovered that QEMU incorrectly handled the Cirrus\nVGA device. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code on the host. In the default installation, when QEMU is used\nwith libvirt, attackers would be isolated by the libvirt AppArmor profile.\n(CVE-2017-2615)\n\nIt was discovered that QEMU incorrectly handled the Cirrus VGA device. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service, or possibly execute arbitrary code\non the host. In the default installation, when QEMU is used with libvirt,\nattackers would be isolated by the libvirt AppArmor profile.\n(CVE-2017-2620)\n\nIt was discovered that QEMU incorrectly handled VNC connections. An\nattacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2017-2633)\n\nLi Qiang discovered that QEMU incorrectly handled the ac97 audio device. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2017-5525)\n\nLi Qiang discovered that QEMU incorrectly handled the es1370 audio device.\nA privileged attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2017-5526)\n\nLi Qiang discovered that QEMU incorrectly handled the 16550A UART device. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2017-5579)\n\nJiang Xin discovered that QEMU incorrectly handled SDHCI device emulation.\nA privileged attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode on the host. In the default installation, when QEMU is used with\nlibvirt, attackers would be isolated by the libvirt AppArmor profile.\n(CVE-2017-5667)\n\nLi Qiang discovered that QEMU incorrectly handled the MegaRAID SAS device.\nA privileged attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2017-5856)\n\nLi Qiang discovered that QEMU incorrectly handled the CCID Card device. A\nprivileged attacker inside the guest could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2017-5898)\n\nLi Qiang discovered that QEMU incorrectly handled USB xHCI controller\nemulation. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service. (CVE-2017-5973)\n\nJiang Xin and Wjjzhang discovered that QEMU incorrectly handled SDHCI\ndevice emulation. A privileged attacker inside the guest could use this\nissue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2017-5987)\n\nLi Qiang discovered that QEMU incorrectly handled USB OHCI controller\nemulation. A privileged attacker inside the guest could use this issue to\ncause QEMU to hang, resulting in a denial of service. (CVE-2017-6505)\n","status":"published","published":"2017-04-20T18:33:13Z","modified":"2026-02-10T04:41:06Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}