CVE-2010-3851
published 2010-11-04CVE-2010-3851: libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows…
PriorityP413medium4.7CVSS 2.0
AVLACMAuNCCINAN
EPSS
0.38%
30.7th percentile
libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libguestfs | libguestfs | <= 1.5.22 | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
| libguestfs | libguestfs | — | — |
CVSS provenance
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:C/I:N/A:N
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libguestfs: missing disk format specifier when adding a disk
vendor_redhat·2010-10-14·CVSS 4.7
CVE-2010-3851 [MEDIUM] libguestfs: missing disk format specifier when adding a disk
libguestfs: missing disk format specifier when adding a disk
libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.
GHSA
GHSA-vc83-g5p3-ggc5: libguestfs before 1
ghsa_unreviewed·2022-05-17
CVE-2010-3851 [MEDIUM] CWE-200 GHSA-vc83-g5p3-ggc5: libguestfs before 1
libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-3851 libguestfs: missing disk format specifier when adding a disk [fedora-all]
bugzilla·2010-10-18·CVSS 4.7
CVE-2010-3851 [MEDIUM] CVE-2010-3851 libguestfs: missing disk format specifier when adding a disk [fedora-all]
CVE-2010-3851 libguestfs: missing disk format specifier when adding a disk [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=643958
Please note: this issue aff
Bugzilla
CVE-2010-3851 libguestfs: missing disk format specifier when adding a disk
bugzilla·2010-10-18·CVSS 4.7
CVE-2010-3851 [MEDIUM] CVE-2010-3851 libguestfs: missing disk format specifier when adding a disk
CVE-2010-3851 libguestfs: missing disk format specifier when adding a disk
Libguestfs doesn't currently allow the format of a disk to be specified explicitly. Because of that malicious guest admin can exploit automatic image format detection in qemu, when the libguestfs is used to administer the image, to read arbitrary file on host via forging a image header with backing store.
Discussion:
--- Additional comment from [email protected] on 2010-10-07 17:13:27 EDT ---
The risk seems to be as follows:
(1) Malicious guest is using a raw-format disk image.
(2) Guest writes a carefully crafted qcow2, VMDK or VDI header
into their own raw disk, and also replaces some binary that one
of our tools might run (/usr/bin/rpm would be a good candidate).
The header says that this (fake) qcow2 image
Bugzilla
No way to specify disk format when adding a disk to libguestfs
bugzilla·2010-10-14
[MEDIUM] No way to specify disk format when adding a disk to libguestfs
No way to specify disk format when adding a disk to libguestfs
+++ This bug was initially created as a clone of Bug #641008 +++
Description of problem:
There is a well-known problem with automatic volume format detection in qemu: if a disk was originally raw and qemu is configured to auto-detect disk formats, a malicious guest administrator can add a qcow2 header to the beginning of the raw disk which specifies an alternate backing store, for example a file or block device on the virtualisation host. After reboot, qemu will incorrectly detect the block device as qcow2, and deliver the backing store data to the guest. In this way, a guest administrator can compromise the host. The solution is to specify the disk format to qemu explicitly when launching the host, which disables automatic f
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050237.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/050742.htmlhttp://rwmj.wordpress.com/2010/10/23/new-libguestfs-stable-versions/http://secunia.com/advisories/41797http://secunia.com/advisories/42235http://www.redhat.com/support/errata/RHSA-2011-0586.htmlhttp://www.securityfocus.com/bid/44166http://www.vupen.com/english/advisories/2010/2874http://www.vupen.com/english/advisories/2010/2963https://bugzilla.redhat.com/show_bug.cgi?id=643958https://www.redhat.com/archives/libguestfs/2010-October/msg00036.htmlhttps://www.redhat.com/archives/libguestfs/2010-October/msg00037.htmlhttps://www.redhat.com/archives/libguestfs/2010-October/msg00041.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/050237.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/050742.htmlhttp://rwmj.wordpress.com/2010/10/23/new-libguestfs-stable-versions/http://secunia.com/advisories/41797http://secunia.com/advisories/42235http://www.redhat.com/support/errata/RHSA-2011-0586.htmlhttp://www.securityfocus.com/bid/44166http://www.vupen.com/english/advisories/2010/2874http://www.vupen.com/english/advisories/2010/2963https://bugzilla.redhat.com/show_bug.cgi?id=643958https://www.redhat.com/archives/libguestfs/2010-October/msg00036.htmlhttps://www.redhat.com/archives/libguestfs/2010-October/msg00037.htmlhttps://www.redhat.com/archives/libguestfs/2010-October/msg00041.html
2010-11-04
Published