VulnerabilityModified

CVE-2019-10161

HIGH 7.8EPSS 0.52%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.52% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-284, CWE-22, CWE-862
Affected: redhat/libvirt · redhat/enterprise linux · redhat/virtualization · redhat/virtualization host · canonical/ubuntu linux
Source: secalert@redhat.com

References

https://access.redhat.com/libvirt-privesc-vulnerabilitiesThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161Issue Tracking, Patch, Third Party Advisory
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=aed6a032cead4386472afb24b16196579e239580
https://security.gentoo.org/glsa/202003-18Third Party Advisory
https://usn.ubuntu.com/4047-2/Third Party Advisory
https://access.redhat.com/libvirt-privesc-vulnerabilitiesThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161Issue Tracking, Patch, Third Party Advisory
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=aed6a032cead4386472afb24b16196579e239580
https://security.gentoo.org/glsa/202003-18Third Party Advisory
https://usn.ubuntu.com/4047-2/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.