The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Nov 2, 2013 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Nov 2, 2013 |
| Suse | — | Upgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-networkUpgrade libvirt-clientUpgrade libvirt-lock-sanlockUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-libsUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-secretUpgrade libvirtUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemonUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-develUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-rbd | Aug 9, 2024 | Nov 2, 2013 |
| Ubuntu | — | Upgrade libvirt0 | Nov 8, 2024 | Nov 2, 2013 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub