An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Apr 4, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-clientUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-networkUpgrade libvirtUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nodedev | Dec 4, 2019 | Apr 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-kvmUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-networkUpgrade libvirt-bash-completionUpgrade libvirt-clientUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-config-nwfilter | Feb 9, 2023 | Apr 4, 2019 |
| Suse | — | Upgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-interfaceUpgrade libvirtUpgrade libvirt-daemonUpgrade libvirt-libsUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-adminUpgrade libvirt-clientUpgrade libvirt-nssUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-bash-completionUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-develUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-config-networkUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-libxl | Apr 16, 2019 | Apr 4, 2019 |
| Ubuntu | — | Upgrade libvirt-daemonUpgrade libvirt-clientsUpgrade libvirt0 | Jun 20, 2019 | Apr 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub