# CVE-2016-9386: Xen x86 emulator privilege escalation via NULL segment handling

Source: https://junglewise.ai/threats/cve-2016-9386-xen-x86-emulator-privilege-escalation-via-null-segment-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9386 · Severity: high · CVSS 7.8 · Published 2017-01-23

A vulnerability in the Xen hypervisor, which is used to run multiple virtual machines on a single physical server, could allow a user inside a virtual machine to gain unauthorized control over that guest operating system. By exploiting a flaw in how the system handles memory segments, an unprivileged program could bypass security boundaries to gain administrative rights within the virtual environment. This could lead to unauthorized access to sensitive data or the disruption of services running on the affected virtual machine.

Technologies: [Citrix Xenserver](https://junglewise.ai/threats/technologies/xenserver), [Xen Project Xen](https://junglewise.ai/threats/technologies/xen). Vendors: [Citrix](https://junglewise.ai/threats/vendors/citrix), [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2016-9386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9386 being exploited in the wild.

**How severe is CVE-2016-9386?** High severity, with a CVSS score of 7.8, published 23 January 2017.

**Which products and versions are affected?** Citrix Xenserver 6.0.2, 6.2.0, 6.5, 7.0; Xen Project Xen All versions; fixed in 4.7.1-r4, 4.6.x, 4.5.x, 4.4.x with patches.

**Is there a fix for CVE-2016-9386?** A patch was published on 2016-11-22: Patches released for Xen unstable, 4.7.x, 4.6.x, 4.5.x, and 4.4.x Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-9386 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2016-9386?** Check whether you run Citrix Xenserver or Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Xen x86 emulator erroneously fails to consider the 'unusable' attribute of segments when performing memory accesses. Specifically, while NULL selectors are intended to prevent access in 32-bit mode (and for LDT system segments in both 32/64-bit), the emulator may permit access using stale or unexpected base/limit values. On Intel hardware, loading a NULL selector zeros the base but sets the limit to its maximum; on AMD, it may leave stale base/limit values intact. An unprivileged guest user can exploit this logic error to bypass memory protections and escalate privileges to that of the guest kernel. The issue is restricted to HVM guests; PV guests and ARM-based systems are not affected. Patches are available for all supported Xen versions (XSA-191).

## Affected products

- Xen Project Xen All versions; fixed in 4.7.1-r4, 4.6.x, 4.5.x, 4.4.x with patches
- Citrix XenServer 6.0.2, 6.2.0, 6.5, 7.0

## Timeline

- 2016-11-22: advisory: Xen Project released XSA-191
- 2016-11-22: patched: Patches released for Xen unstable, 4.7.x, 4.6.x, 4.5.x, and 4.4.x
- 2017-01-23: disclosed: NVD publication date

## References

- [http://www.securityfocus.com/bid/94471](http://www.securityfocus.com/bid/94471)
- [http://www.securitytracker.com/id/1037340](http://www.securitytracker.com/id/1037340)
- [http://xenbits.xen.org/xsa/advisory-191.html](http://xenbits.xen.org/xsa/advisory-191.html)
- [https://security.gentoo.org/glsa/201612-56](https://security.gentoo.org/glsa/201612-56)
- [https://support.citrix.com/article/CTX218775](https://support.citrix.com/article/CTX218775)

## Related threats

- [Xen arbitrary read/write via grant copy caching](https://junglewise.ai/threats/cve-2026-102704-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen hypervisor arbitrary read/write via grant copy](https://junglewise.ai/threats/cve-2026-102703-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen VMX VMentry failure with branch tracing and blocked states](https://junglewise.ai/threats/cve-2026-79611-for-xsa-308-logic-was-introduced-as-vmx-vmentry-checks-do-not)
- [Xen XPTI privilege escalation on huge-memory systems](https://junglewise.ai/threats/cve-2026-79609-xpti-xen-page-table-isolation-was-introduced-to-mitigate-meltdown)
- [Xen ineffectual Zenbleed workaround on AMD x86](https://junglewise.ai/threats/cve-2026-79608-the-workaround-for-xsa-433-zenbleed-was-later-re-worked-to-better)