Auth bypass in Libvirt
CVE-2019-10161
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (42.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 42.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Libvirt — versions fixed in 4.10.1, fixed in 5.4.1
- Canonical Ubuntu Linux — versions 14.04
- Red Hat Enterprise Linux — versions 6.0, 7.0, 8.0
- Red Hat Libvirt
- Red Hat Virtualization — versions 4.0
- Red Hat Virtualization Host — versions 4.0
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Patch, Third Party Advisory, Issue Tracking)
- access.redhat.com/libvirt-privesc-vulnerabilities (Third Party Advisory)
- libvirt.org/git/
- usn.ubuntu.com/4047-2/ (vendor-advisory, Third Party Advisory)
- security.gentoo.org/glsa/202003-18 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-10161?
- CVE-2019-10161 is a high-severity vulnerability in Libvirt, classified under Improper Access Control. CVSS score: 7.8/10. Published 2019-07-30.
- How severe is CVE-2019-10161?
- High severity. CVSS v3 base score is 7.8 out of 10.