PT-2013-4938 · Red Hat+1 · Libvirt+1

Petr Matousek · Publicado 2013-09-30 · Atualizado 2023-02-13 · CVE-2013-4291

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libvirt versions 0.10.2.7, 1.0.5.5, and 1.1.1

Description The issue arises from the virSecurityManagerSetProcessLabel function in libvirt, which fails to properly set group memberships when the domain has read an uid:gid label. This allows local users to gain privileges.

Recommendations For libvirt version 0.10.2.7, update to a version that fixes the issue with the virSecurityManagerSetProcessLabel function. For libvirt version 1.0.5.5, update to a version that fixes the issue with the virSecurityManagerSetProcessLabel function. For libvirt version 1.1.1, update to a version that fixes the issue with the virSecurityManagerSetProcessLabel function.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-4291

Produtos afetados

Suse

Libvirt

Referências · 9

• 🔥 http://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=fe11d34a6d46d6641ce90dc665164fda7bb6bff8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4291 · Nota de Segurança
• http://libvirt.org/news.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4291 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1006509 · Correção
• http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fe11d34a6d46d6641ce90dc665164fda7bb6bff8 · Nota
• https://osv.dev/vulnerability/CVE-2013-4291 · Aviso do Fabricante
• http://wiki.libvirt.org/page/Maintenance_Releases · Correção
• https://security-tracker.debian.org/tracker/CVE-2013-4291 · Aviso do Fabricante