libvirtd up to 4.10.0/5.4.0 API virDomainManagedSaveDefineXML access control

Summaryinfo

A vulnerability categorized as critical has been discovered in libvirtd up to 4.10.0/5.4.0. Impacted is the function virDomainManagedSaveDefineXML of the component API. Such manipulation leads to access control. This vulnerability is traded as CVE-2019-10166. An attack has to be approached locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in libvirtd up to 4.10.0/5.4.0 (Virtualization Software). It has been rated as critical. Affected by this issue is the function virDomainManagedSaveDefineXML of the component API. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

The weakness was shared 08/02/2019 (Website). The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2019-10166 since 03/27/2019. The attack needs to be approached locally. The successful exploitation needs a simple authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 276357 (TencentOS Server 3: virt:rhel and virt-devel:rhel (TSSA-2022:0119)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.10.1 or 5.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (276357). The entries VDB-139034, VDB-139365 and VDB-139366 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• libvirtd

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10.0
• 5.0
• 5.1
• 5.2
• 5.3
• 5.4.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion