VulnerabilityModified
CVE-2016-9867
A low-privileged local attacker may be able to modify the kernel memory in the SCINI driver and may achieve code execution to escalate privileges to root on ScaleIO Data Client (SDC) servers.
HIGH 8.8EPSS 0.39%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may be able to modify the kernel memory in the SCINI driver and may achieve code execution to escalate privileges to root on ScaleIO Data Client (SDC) servers.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.39% probability · 33th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- emc/scaleio
- Source
- security_alert@emc.com
References
- http://www.securityfocus.com/archive/1/539983/30/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/95300
- http://www.securityfocus.com/archive/1/539983/30/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/95300
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.