Vulnerability in Red Hat Libvirt

CVE-2013-4291

The virSecurityManagerSetProcessLabel function in libvirt 0.10.2.7, 1.0.5.5, and 1.1.1, when the domain has read an uid:gid label, does not properly set group memberships, which allows local users to gain privileges.

EPSS: 0.005 (39.2th percentile) — read the EPSS interpretation.

Affected products

  • Redhat Libvirt — versions 0.10.2.7, 1.0.5.5, 1.1.1
  • N/a — versions n/a

Weakness classification (CWE)

References