libvirtd up to 4.10.0/5.4.0 API virConnectGetDomainCapabilities emulatorbin access control

Summaryinfo

A vulnerability identified as critical has been detected in libvirtd up to 4.10.0/5.4.0. The affected element is the function virConnectGetDomainCapabilities of the component API. Performing a manipulation of the argument emulatorbin as part of Argument results in access control. This vulnerability is known as CVE-2019-10167. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in libvirtd up to 4.10.0/5.4.0 (Virtualization Software). This affects the function virConnectGetDomainCapabilities of the component API. The manipulation of the argument emulatorbin as part of a Argument leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

The weakness was published 08/02/2019 (Website). The advisory is shared at access.redhat.com. This vulnerability is uniquely identified as CVE-2019-10167 since 03/27/2019. The exploitability is told to be easy. An attack has to be approached locally. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 276357 (TencentOS Server 3: virt:rhel and virt-devel:rhel (TSSA-2022:0119)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.10.1 or 5.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (276357). Similar entries are available at VDB-139034, VDB-139364 and VDB-139366. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Virtualization Software

Name

• libvirtd

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10.0
• 5.0
• 5.1
• 5.2
• 5.3
• 5.4.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion