PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9039 Joyent CVE debrief

CVE-2016-9039 is a medium-severity denial-of-service issue in Joyent SmartOS Hyprlofs file system handling. Repeated use of the HYPRLOFS_ADD_ENTRIES ioctl can cause memory to be allocated and never freed, eventually exhausting system memory and denying service.

Vendor
Joyent
Product
Unknown
CVSS
MEDIUM 6.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators and operators running the affected Joyent SmartOS 20161110T013148Z build, especially systems exposing or relying on Hyprlofs functionality. Security teams should also care because the issue can be triggered locally and can impact system availability.

Technical summary

NVD describes the flaw as a CWE-400 resource-management problem affecting the Hyprlofs file system in Joyent SmartOS 20161110T013148Z. The vulnerable path is the ioctl command HYPRLOFS_ADD_ENTRIES, where a buffer can be allocated but not released. The NVD CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which aligns with a local, no-privileges availability impact rather than a confidentiality or integrity issue.

Defensive priority

Medium

Recommended defensive actions

  • Identify whether any hosts run the affected SmartOS 20161110T013148Z build or any environment that includes the vulnerable Hyprlofs component.
  • Apply vendor guidance or update to a non-vulnerable SmartOS release if one is available from Joyent.
  • Restrict local access to systems where practical, since the CVSS vector indicates a local attack path.
  • Monitor for unexplained memory growth or service instability on affected hosts and investigate Hyprlofs/ioctl-related activity.
  • Treat repeated failures or memory exhaustion events as a potential indicator of attempted abuse and include this CVE in patch validation and asset inventory checks.

Evidence notes

This debrief is based on the supplied NVD CVE record and its referenced advisories. The NVD entry identifies the weakness as CWE-400 and gives a CVSS 3.0 vector of AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The record’s references point to a SecurityFocus BID entry and a Talos technical report, which are the only non-NVD sources provided in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9039 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9039

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9039 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9039

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.