CVE-2016-7093

2016-09-2114:25:00

Debian Security Bug Tracker

security-tracker.debian.org

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

25.7%

JSON

Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation.

OSVersionArchitecturePackageVersionFilename
Debian12allxen< 4.17.3+10-g091466ba55-1~deb12u1xen_4.17.3+10-g091466ba55-1~deb12u1_all.deb
Debian11allxen< 4.14.6-1xen_4.14.6-1_all.deb
Debian10allxen< 4.11.4+107-gef32c7afa2-1xen_4.11.4+107-gef32c7afa2-1_all.deb
Debian999allxen< 4.17.3+36-g54dacb5c02-1xen_4.17.3+36-g54dacb5c02-1_all.deb
Debian13allxen< 4.17.3+36-g54dacb5c02-1xen_4.17.3+36-g54dacb5c02-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	xen	< 4.17.3+10-g091466ba55-1~deb12u1	xen_4.17.3+10-g091466ba55-1~deb12u1_all.deb
Debian	11	all	xen	< 4.14.6-1	xen_4.14.6-1_all.deb
Debian	10	all	xen	< 4.11.4+107-gef32c7afa2-1	xen_4.11.4+107-gef32c7afa2-1_all.deb
Debian	999	all	xen	< 4.17.3+36-g54dacb5c02-1	xen_4.17.3+36-g54dacb5c02-1_all.deb
Debian	13	all	xen	< 4.17.3+36-g54dacb5c02-1	xen_4.17.3+36-g54dacb5c02-1_all.deb