PT-2013-4938 · Red Hat+1 · Libvirt+1

Petr Matousek · Published 2013-09-30 · Updated 2023-02-13 · CVE-2013-4291

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libvirt versions 0.10.2.7, 1.0.5.5, and 1.1.1

Description The issue arises from the virSecurityManagerSetProcessLabel function in libvirt, which fails to properly set group memberships when the domain has read an uid:gid label. This allows local users to gain privileges.

Recommendations For libvirt version 0.10.2.7, update to a version that fixes the issue with the virSecurityManagerSetProcessLabel function. For libvirt version 1.0.5.5, update to a version that fixes the issue with the virSecurityManagerSetProcessLabel function. For libvirt version 1.1.1, update to a version that fixes the issue with the virSecurityManagerSetProcessLabel function.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-4291

Affected Products

Suse

Libvirt

References · 9

• 🔥 http://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=fe11d34a6d46d6641ce90dc665164fda7bb6bff8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4291 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4291 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1006509 · Patch
• https://osv.dev/vulnerability/CVE-2013-4291 · Vendor Advisory
• http://wiki.libvirt.org/page/Maintenance_Releases · Patch
• https://security-tracker.debian.org/tracker/CVE-2013-4291 · Vendor Advisory
• http://libvirt.org/news.html · Note
• http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fe11d34a6d46d6641ce90dc665164fda7bb6bff8 · Note