PT-2019-2885 · Libvirt+5 · Libvirt+5

Published 2019-06-13 · Updated 2024-06-15 · CVE-2019-10168

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libvirt versions 4.x.x through 4.10.0 libvirt versions 5.x.x through 5.4.0

Description The issue is caused by access control errors in the virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() functions of the libvirt library. Exploitation of this issue may allow an attacker to execute arbitrary code or elevate their privileges. The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() APIs accept an emulator argument, which can be used to specify the program providing emulation for a domain. Since version 1.2.19, libvirt executes the specified program to probe the domain's capabilities, allowing read-only clients to potentially execute a crafted executable with elevated privileges by specifying an arbitrary path for the emulator argument.

Recommendations For libvirt versions 4.x.x through 4.10.0, update to version 4.10.1 or later. For libvirt versions 5.x.x through 5.4.0, update to version 5.4.1 or later. As a temporary workaround, consider restricting access to the virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() functions until a patch is available.

Fix

Improper Access Control

Path traversal

Weakness Enumeration

CWE-284

CWE-250

CWE-22

Related Identifiers

ALT-PU-2019-2222

ALT-PU-2019-2225

BDU:2019-02854

CESA-2019_1579

CESA-2019_1580

CVE-2019-10168

MGASA-2019-0390

OPENSUSE-SU-2019:1753-1

OPENSUSE-SU-2019_1753-1

OPENSUSE-SU-2024:11008-1

RHSA-2019:1579

RHSA-2019:1580

RHSA-2019:1699

RHSA-2019:1762

RHSA-2019_1579

RHSA-2019_1580

SUSE-SU-2019:1643-1

USN-4047-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Libvirt

References · 57

• https://nvd.nist.gov/vuln/detail/CVE-2019-10168 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0390 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10168 · Vendor Advisory
• https://access.redhat.com/libvirt-privesc-vulnerabilities · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10168 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10161 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10167 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4047-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1753-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10166 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-18 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10168 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10168 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-10168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02854 · Security Note