An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Apr 4, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-networkUpgrade libvirtUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storageUpgrade libvirt-clientUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-lxc | Dec 4, 2019 | Apr 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-libsUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemonUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-storageUpgrade libvirt-client | Feb 9, 2023 | Apr 4, 2019 |
| Suse | — | Upgrade libvirt-develUpgrade libvirt-bash-completionUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-client-32bitUpgrade libvirt-nssUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-clientUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-xenUpgrade libvirt-adminUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemonUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-config-nwfilterUpgrade libvirtUpgrade libvirt-daemon-driver-storage-scsi | Apr 16, 2019 | Apr 4, 2019 |
| Ubuntu | — | Upgrade libvirt-clientsUpgrade libvirt0Upgrade libvirt-daemon | Jun 20, 2019 | Apr 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub