VulnerabilityModified
CVE-2012-2693
libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access…
LOW 3.7EPSS 0.33%
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices.
- CVSS 2.0
- 3.7 LOWAV:L/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 0.33% probability · 26th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- redhat/libvirt
- Source
- secalert@redhat.com
References
- http://rhn.redhat.com/errata/RHSA-2012-0748.html
- http://rhn.redhat.com/errata/RHSA-2013-0127.html
- http://www.openwall.com/lists/oss-security/2012/06/11/2
- http://www.openwall.com/lists/oss-security/2012/06/11/3
- https://www.redhat.com/archives/libvir-list/2012-April/msg01494.htmlPatch
- http://rhn.redhat.com/errata/RHSA-2012-0748.html
- http://rhn.redhat.com/errata/RHSA-2013-0127.html
- http://www.openwall.com/lists/oss-security/2012/06/11/2
- http://www.openwall.com/lists/oss-security/2012/06/11/3
- https://www.redhat.com/archives/libvir-list/2012-April/msg01494.htmlPatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.