CVE-2016-4962

Description

The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.

CVSS Metrics

• v3.0•MEDIUM•Score: 6.7CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• v2.0•MEDIUM•Score: 6.8AV:L/AC:L/Au:S/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.09%• Percentile: 25%

Techniques & Countermeasures

• CWE-264•Permissions, Privileges, and Access Controls

  Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected Systems

• oracle•vm_server

  3.3 | 3.4

• xen•xen

  4.3.0 | 4.3.1 | 4.3.2 | 4.3.3 | 4.3.4 | 4.4.0 | 4.4.0:rc1 | 4.4.1 | 4.4.2 | 4.4.3 | 4.4.4 | 4.5.0 | 4.5.1 | 4.5.2 | 4.5.3 | 4.6.0 | 4.6.1

References (5)

• http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
• http://xenbits.xen.org/xsa/advisory-175.html
• http://www.securityfocus.com/bid/91006
• http://www.debian.org/security/2016/dsa-3633
• http://www.securitytracker.com/id/1036023