← Vulnerability feed

Vulnerability record · CVE-2016-9040 · published 7 September 2018

CVE-2016-9040: Joyent smartos uncontrolled resource consumption vulnerability

JJoyent · Smartos

An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploit this will result in memory exhaustion, resulting in a full system denial of service.

5.5 CVSS 3.1 Medium EPSS 0.47% · top 61.3% CWE-400 · Uncontrolled resource consumption
5.5CVSS 3.1 base score, v2 4.9
0.47%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploit this will result in memory exhaustion, resulting in a full system denial of service.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0258 ExploitTechnical DescriptionThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0258 ExploitTechnical DescriptionThird Party Advisory

Track CVE-2016-9040 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-27678Illumos classic buffer overflow vulnerabilityAn issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There …EPSS 1.4%8.8CVE-2016-8733Joyent smartos integer overflow vulnerabilityAn exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system …EPSS 0.55%7.8CVE-2018-1166Joyent smartos use after free vulnerabilityThis vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An …EPSS 0.38%7.8CVE-2016-9031Joyent smartos integer overflow vulnerabilityAn exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system …EPSS 0.49%7.2CVE-2012-0217Freebsd memory buffer overflow vulnerabilityThe x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solari…EPSS 40%7.0CVE-2018-1171Joyent smartos out-of-bounds write vulnerabilityThis vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An …EPSS 0.44%7.0CVE-2018-1165Joyent smartos heap-based buffer overflow vulnerabilityThis vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An …EPSS 0.50%7.0CVE-2016-9035Joyent smartos classic buffer overflow vulnerabilityAn exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system c…EPSS 0.54%

Source: NIST National Vulnerability Database (record CVE-2016-9040), CISA KEV, FIRST EPSS (scores of 2026-10-04). This page is refreshed as NVD updates the record.