PT-2019-2884 · Red Hat+4 · Libvirt+5

Doran Moppert

·

Published

2019-06-20

·

Updated

2024-06-15

·

CVE-2019-10167

CVSS v3.1

8.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions libvirt versions 4.x.x through 4.10.0 libvirt versions 5.x.x through 5.4.0
Description The issue is related to the virConnectGetDomainCapabilities() function in the libvirt API, which accepts an emulatorbin argument. This argument can be used to specify a program for domain emulation. Since version 1.2.19, libvirt executes the specified program to probe domain capabilities. A problem arises because read-only clients can provide an arbitrary path for the emulatorbin argument, potentially causing libvirtd to execute a crafted executable with its own privileges. This is due to errors in access control.
Recommendations For libvirt versions 4.x.x through 4.10.0, update to version 4.10.1 or later. For libvirt versions 5.x.x through 5.4.0, update to version 5.4.1 or later. As a temporary workaround, consider restricting access to the virConnectGetDomainCapabilities() function until a patch is available. Avoid using the emulatorbin argument in the affected API endpoint until the issue is resolved.

Fix

Improper Access Control

Missing Authorization

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2019-2222
ALT-PU-2019-2225
BDU:2019-02853
CESA-2019_1579
CESA-2019_1580
CVE-2019-10167
DLA-1832-1
DSA-4469-1
MGASA-2019-0390
OPENSUSE-SU-2019:1672-1
OPENSUSE-SU-2019:1753-1
OPENSUSE-SU-2019_1672-1
OPENSUSE-SU-2019_1753-1
OPENSUSE-SU-2024:11008-1
RHSA-2019:1579
RHSA-2019:1580
RHSA-2019:1699
RHSA-2019:1762
RHSA-2019_1579
RHSA-2019_1580
SUSE-SU-2019:1599-1
SUSE-SU-2019:1637-1
SUSE-SU-2019:1643-1
SUSE-SU-2019:1686-1
SUSE-SU-2019:2105-1
SUSE-SU-2019:2227-1
SUSE-SU-2019:2227-2
USN-4047-1

Affected Products

Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libvirt