Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.
CVSS Details
- CVSS 3.1 Base Score: 9.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storageUpgrade libvirt-nssUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-libsUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-lock-sanlockUpgrade libvirt-daemonUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-develUpgrade libvirt-daemon-lxcUpgrade libvirt-docUpgrade wireshark-plugin-libvirtUpgrade libvirt-devel-32bitUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-clientUpgrade libvirtUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-core | Oct 21, 2020 | Aug 4, 2020 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-daemon-systemUpgrade libvirt-daemon | Aug 5, 2020 | Aug 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub