Is CVE-2016-9379 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9379 being exploited in the wild.

How severe is CVE-2016-9379?

High severity, with a CVSS score of 7.9, published 23 January 2017.

Which products and versions are affected?

Citrix Xenserver 6.0.2, 6.2.0, 6.5, 7.0; Xen Project Xen 2.0 and later.

Is there a fix for CVE-2016-9379?

A patch was published on 2016-11-22: Patch released by Xen Project Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-9379 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2016-9379?

Check whether you run Citrix Xenserver or Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9379: Xen pygrub delimiter injection in S-expression output

CVE-2016-9379 · Severity: high · CVSS 7.9 · Published 2017-01-23

Xen is a hypervisor used to run multiple virtual machines on a single physical server. A vulnerability in its pygrub boot loader emulator allows an administrator of a guest virtual machine to trick the host system into reading or deleting files on the physical server. This could lead to the exposure of sensitive host data or a service outage if critical system files are removed.

Technologies: Citrix Xenserver, Xen Project Xen. Vendors: Citrix, Xen Project.

Quick answers

Is CVE-2016-9379 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9379 being exploited in the wild.
How severe is CVE-2016-9379?: High severity, with a CVSS score of 7.9, published 23 January 2017.
Which products and versions are affected?: Citrix Xenserver 6.0.2, 6.2.0, 6.5, 7.0; Xen Project Xen 2.0 and later.
Is there a fix for CVE-2016-9379?: A patch was published on 2016-11-22: Patch released by Xen Project Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9379 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2016-9379?: Check whether you run Citrix Xenserver or Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A delimiter injection vulnerability exists in the pygrub boot loader emulator within Xen. When the S-expression output format is requested, pygrub fails to properly quote or validate results reported to the toolstack (libxl, xl, or libvirt). A malicious guest administrator can craft a bootloader configuration file containing specific string quotes and S-expressions to manipulate the toolstack into treating arbitrary host files as the guest's initial ramdisk. This allows the guest to read the contents of those host files or cause the toolstack to delete them during the boot process. The vulnerability affects systems where guests are configured to boot using pygrub (typically PV domains on x86).

Affected products

Xen Project Xen 2.0 and later
Citrix XenServer 6.0.2, 6.2.0, 6.5, 7.0

Timeline

2016-11-22: disclosed: Initial public release of XSA-198
2016-11-22: patched: Patch released by Xen Project
2017-01-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.