Read the docs
TI-2016-07402 Aliases CVE-2016-9039GHSA-h4vg-vpxq-866j

Uncontrolled resource consumption in Joyent SmartOS

Priority LOW 28CWE-400Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploited this will result in memory exhaustion, resulting in a full system denial of service.

Why it matters now

EPSS 0.00516 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JoyentSmartOSOS 20161110T013148Z—No fix listedCNA
  • SmartOS VendorJoyent Affected OS 20161110T013148Z Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:joyent:smartos:20161110t013148z:*:*:*:*:*:*:*20161110t013148zVulnerableJoyent
  • cpe:2.3:o:joyent:smartos:20161110t013148z:*:*:*:*:*:*:* Versions 20161110t013148z Vulnerable ·Joyent

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9039
  2. 2026-10-03 Alias added: GHSA-h4vg-vpxq-866j

References

Exploit 1

  • TI-2012-00210 The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix… CVSS 2.0HIGH 7.2
  • TI-2021-19340 An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90… CVSS 3.1MEDIUM 5.5
  • TI-2020-16788 An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by… CVSS 3.1CRITICAL 9.8
  • TI-2016-07190 Integer overflow in Joyent SmartOS CVSS 3.1HIGH 8.8
  • TI-2016-07394 Integer overflow in Joyent SmartOS CVSS 3.1HIGH 7.8
  • TI-2018-01082 Use after free in Joyent SmartOS CVSS 3.0HIGH 7.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences