libvirtd up to 4.10.0/5.4.0 API virDomainSaveImageGetXMLDesc access control

Summaryinfo

A vulnerability classified as critical was found in libvirtd up to 4.10.0/5.4.0. Impacted is the function virDomainSaveImageGetXMLDesc of the component API. Such manipulation leads to access control. This vulnerability is traded as CVE-2019-10161. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in libvirtd up to 4.10.0/5.4.0 (Virtualization Software). Affected by this issue is the function virDomainSaveImageGetXMLDesc of the component API. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

The weakness was shared 07/30/2019 (Website). The advisory is available at access.redhat.com. This vulnerability is handled as CVE-2019-10161 since 03/27/2019. The exploitation is known to be easy. Local access is required to approach this attack. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 276357 (TencentOS Server 3: virt:rhel and virt-devel:rhel (TSSA-2022:0119)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.10.1 or 5.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (276357). The entries VDB-139364, VDB-139365 and VDB-139366 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Virtualization Software

Name

• libvirtd

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10.0
• 5.0
• 5.1
• 5.2
• 5.3
• 5.4.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion