4.4
CVSSv2

CVE-2010-2238

Published: 19/08/2010 Updated: 30/10/2010
CVSS v2 Base Score: 4.4 | Impact Score: 6.9 | Exploitability Score: 2.7
VMScore: 392
Vector: AV:L/AC:M/Au:S/C:C/I:N/A:N

Vulnerability Summary

Red Hat libvirt, possibly 0.7.2 up to and including 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.

Vulnerable Product Search on Vulmon Subscribe to Product

libvirt libvirt 0.7.2

libvirt libvirt 0.8.1

libvirt libvirt 0.7.4

libvirt libvirt 0.7.5

libvirt libvirt 0.7.6

libvirt libvirt 0.7.7

libvirt libvirt 0.7.3

libvirt libvirt 0.8.0

libvirt libvirt 0.8.2

Vendor Advisories

This update restores ‘host_device’ support for domain XML on Ubuntu 1004 LTS ...
Libvirt could be made to crash or read arbitrary files on the host ...
Guest VMs could be made to circumvent security protections to access resources on the host ...
This update reenables recent bug fixes ...
Updated virtinst for use with the new libvirt ...