Is CVE-2016-9382 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9382 being exploited in the wild.

How severe is CVE-2016-9382?

High severity, with a CVSS score of 7.8, published 23 January 2017.

Which products and versions are affected?

Citrix Xenserver 6.0.2, 6.2.0, 6.5, 7.0; Xen Project Xen 4.0.x through 4.7.x.

Is there a fix for CVE-2016-9382?

A patch was published on 2016-11-22: Patches released for affected Xen versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-9382 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2016-9382?

Check whether you run Citrix Xenserver or Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9382: Xen x86 task switch privilege escalation in VM86 mode

CVE-2016-9382 · Severity: high · CVSS 7.8 · Published 2017-01-23

A vulnerability in the Xen hypervisor, which is used to run multiple virtual machines on a single physical server, could allow a user inside a virtual machine to gain unauthorized control over that guest's operating system. On certain hardware, this could also be used to crash the virtual machine, leading to a denial of service. This issue specifically affects older 32-bit virtual machines using specific legacy hardware features.

Technologies: Citrix Xenserver, Xen Project Xen. Vendors: Citrix, Xen Project.

Quick answers

Is CVE-2016-9382 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9382 being exploited in the wild.
How severe is CVE-2016-9382?: High severity, with a CVSS score of 7.8, published 23 January 2017.
Which products and versions are affected?: Citrix Xenserver 6.0.2, 6.2.0, 6.5, 7.0; Xen Project Xen 4.0.x through 4.7.x.
Is there a fix for CVE-2016-9382?: A patch was published on 2016-11-22: Patches released for affected Xen versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9382 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2016-9382?: Check whether you run Citrix Xenserver or Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the way Xen handles x86 hardware task switches when transitioning to VM86 mode. Specifically, the hypervisor failed to follow protected mode semantics for loading the Local Descriptor Table Register (LDTR) during these switches. A local unprivileged user within a 32-bit x86 HVM guest can exploit this flaw if the guest OS utilizes hardware task switching and permits tasks to start in VM86 mode. On AMD (SVM) hardware, this can lead to privilege escalation to the guest kernel level; on both Intel (VMX) and AMD hardware, it can result in a guest crash. PV guests and 64-bit guests are not affected. Patches are available via XSA-192.

Affected products

Xen Project Xen 4.0.x through 4.7.x
Citrix XenServer 6.0.2, 6.2.0, 6.5, 7.0

Timeline

2016-11-22: advisory: XSA-192 published by Xen Project Security Team
2016-11-22: patched: Patches released for affected Xen versions
2017-01-23: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.