Published: 30/07/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

It exists that libvirtd prior to 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat libvirt
redhat enterprise linux 7.0
redhat enterprise linux 6.0
redhat enterprise linux 8.0
redhat virtualization 4.0
redhat virtualization_host 4.0
canonical ubuntu linux 14.04

Several security issues were fixed in libvirt ...

Synopsis Important: libvirt security and bug fix update Type/Severity Security Advisory: Important Topic An update for libvirt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ...

Synopsis Important: virt:rhel security update Type/Severity Security Advisory: Important Topic An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CV ...

Synopsis Important: virt:800 security update Type/Severity Security Advisory: Important Topic An update for the virt:800 module is now available for Red Hat Enterprise Linux 8 Advanced VirtualizationRed Hat Product Security has rated this update as having a security impact of Important A Common Vulner ...

Synopsis Moderate: libvirt security update Type/Severity Security Advisory: Moderate Topic An update for libvirt is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, wh ...

Synopsis Important: redhat-virtualization-host security and enhancement update Type/Severity Security Advisory: Important Topic An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a sec ...

Two vulnerabilities were discovered in Libvirt, a virtualisation abstraction library, allowing an API client with read-only permissions to execute arbitrary commands via the virConnectGetDomainCapabilities API, or read or execute arbitrary files via the virDomainSaveImageGetXMLDesc API Additionally the libvirt's cpu map was updated to make address ...

Impact: Important Public Date: 2019-06-20 CWE: CWE-284 Bugzilla: 1720115: CVE-2019-10161 libvirt: arbit ...

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access (CVE-2019-11091) Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches The wr ...

CWE-22 CWE-862 https://access.redhat.com/libvirt-privesc-vulnerabilities https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161 https://usn.ubuntu.com/4047-2/https://security.gentoo.org/glsa/202003-18 https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=aed6a032cead4386472afb24b16196579e239580 https://nvd.nist.gov https://usn.ubuntu.com/4047-1/

Get Started

CVE-2019-10161

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect