CVE-2016-9379
HighSummary
The pygrub boot loader emulator in Xen allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.
Risk Assessment
This vulnerability may lead to unauthorized access to files on the host, posing a serious threat to the integrity and confidentiality of data.
Recommendation
It is recommended to restrict the privileges of guest OS administrators and review the bootloader configuration to minimize the risk of exploitation of this vulnerability.
Other vulnerabilities in Xen pygrub boot loader emulator
Original NVD description (English source)
The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.