PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9384 Xen CVE debrief

CVE-2016-9384 is a Xen information-disclosure issue affecting Xen 4.7.0 and 4.7.1. According to NVD, a local guest OS user can obtain sensitive host information by loading a 32-bit ELF symbol table. The published CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects a local attack with low privileges, changed scope, and high confidentiality impact.

Vendor
Xen
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

Operators of Xen 4.7.0 and 4.7.1 hosts, especially multi-tenant, cloud, or other shared environments where untrusted guest OS users can run workloads.

Technical summary

The corpus describes a Xen 4.7 flaw in which a guest-side user can trigger disclosure of sensitive host information through handling of a 32-bit ELF symbol table. NVD lists Xen 4.7.0 and 4.7.1 as vulnerable CPEs and maps the issue to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vendor advisory XSA-194 and its patch are the primary remediation references.

Defensive priority

High for shared Xen 4.7 deployments; medium for isolated or non-production environments.

Recommended defensive actions

  • Apply the Xen vendor fix referenced by XSA-194 and the accompanying patch.
  • Inventory Xen 4.7.0 and 4.7.1 systems and confirm they are upgraded or otherwise remediated.
  • Prioritize remediation on hosts that run untrusted or multi-tenant guest workloads.
  • Check downstream distribution advisories, such as Gentoo GLSA-201612-56, for package-specific guidance.

Evidence notes

The CVE record and NVD detail both identify the issue as a Xen guest-to-host information disclosure. NVD provides the CVSS 3.0 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, the CWE-200 mapping, and affected CPEs for Xen 4.7.0 and 4.7.1. Xen advisory XSA-194 and xsa194.patch are the vendor remediation references; Gentoo GLSA-201612-56 is a downstream advisory reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9384 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9384

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9384 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9384

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.