An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Apr 4, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libvirt-daemon-driver-qemuUpgrade libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storageUpgrade libvirt-clientUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-lxc | Dec 4, 2019 | Apr 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvirt-clientUpgrade libvirt-daemon-driver-storageUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemonUpgrade libvirt-daemon-kvmUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-nwfilter | Feb 9, 2023 | Apr 4, 2019 |
| Suse | — | Upgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirtUpgrade libvirt-daemon-lxcUpgrade libvirt-libsUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-xenUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-storageUpgrade libvirt-adminUpgrade libvirt-clientUpgrade libvirt-develUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-config-network | Apr 16, 2019 | Apr 4, 2019 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-clientsUpgrade libvirt-daemon | Jun 20, 2019 | Apr 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub