CVE-2016-9638

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-12-02 · updated 2026-06-17
Weakness: CWE-264

Description

In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to elevate their privileges to root.

Affected products

BMC Patrol: through 9.13.10.01

References

http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrol
http://www.securityfocus.com/bid/95009
http://www.securitytracker.com/id/1037385
http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrol
http://www.securityfocus.com/bid/95009
http://www.securitytracker.com/id/1037385

Get alerted when CVE-2016-9638 or the next vulnerability affects your stack