PT-2012-4186 · Libvirt+2 · Libvirt+2

Petr Matousek · Published 2012-06-17 · Updated 2013-01-15 · CVE-2012-2693

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 0.9.12

Description The issue arises from the improper assignment of USB devices to virtual machines when multiple devices share the same vendor and product ID. This could lead to the wrong device being associated with a guest, potentially allowing local users to access unintended USB devices.

Recommendations For versions prior to 0.9.12, update to version 0.9.12 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2012_0748

CVE-2012-2693

RHSA-2012:0748

RHSA-2012_0748

RHSA-2013:0127

RHSA-2013_0127

Affected Products

Centos

Red Hat

Libvirt

References · 19

• https://security-tracker.debian.org/tracker/CVE-2012-2693 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2693 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0748.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0127.html · Vendor Advisory
• https://redhat.com/archives/libvir-list/2012-April/msg01494.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2693 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-2693 · Security Note
• https://osv.dev/vulnerability/CVE-2012-2693 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-0748.html · Vendor Advisory
• https://lists.centos.org/pipermail/centos-announce/2012-July/030747.html · Note
• https://rhn.redhat.com/errata/RHSA-2012-0748.html · Note
• https://access.redhat.com/security/cve/CVE-2012-2693 · Note
• https://lists.centos.org/pipermail/centos-announce/2012-July/055628.html · Note
• https://access.redhat.com/errata/RHSA-2013:0127 · Note
• http://openwall.com/lists/oss-security/2012/06/11/2 · Note