PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9401 Redhat CVE debrief

CVE-2016-9401 is a local bash issue tied to popd path handling. According to NVD, a local user may be able to bypass a restricted shell and trigger a use-after-free with a crafted address. The published impact is availability-focused, but the restricted-shell bypass makes this important anywhere bash is part of a controlled local access model.

Vendor
Redhat
Product
CVE-2016-9401
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Linux administrators, distro security teams, and operators who rely on bash restricted shells or shared local accounts should care most. Systems running affected GNU bash builds or vendor packages referenced in the Red Hat, Debian LTS, or Gentoo advisories should be prioritized.

Technical summary

NVD classifies the issue as CWE-416 (use-after-free) with CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is described as a local attack against bash's popd behavior, where a crafted address may let a user bypass restricted-shell constraints. The corpus ties the issue to GNU bash and multiple distro package lines, including Red Hat, Debian, and Gentoo references.

Defensive priority

Medium, and higher in environments that depend on restricted shells or local shell confinement. Patch promptly on any supported system with affected bash packages.

Recommended defensive actions

  • Apply the bash security updates referenced by your vendor advisory for the affected platform.
  • Verify the installed bash package version against the affected CPEs in NVD, including GNU bash 4.4 patch levels and the distro releases listed in the record.
  • Review any restricted-shell usage to ensure local users cannot reach popd-related paths unexpectedly.
  • Limit unnecessary local shell access and watch for abnormal bash crashes or shell-restriction violations until remediation is complete.
  • Confirm remediation with the exact vendor package metadata for your system, not just the CVE entry.

Evidence notes

The source corpus shows NVD publication on 2017-01-23 and later modification on 2026-05-13. NVD metadata lists CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-416. The reference set includes two oss-security posts dated 2016-11-17, plus Red Hat, Debian LTS, and Gentoo advisories, which supports an earlier public disclosure timeline before the NVD publication date.

Official resources

Public discussion is reflected in oss-security references dated 2016-11-17, while the CVE record was published by NVD on 2017-01-23 and later modified on 2026-05-13.