CVE-2011-2178 — Redhat Libvirt vulnerability

10 documents8 sources
Severity
4.4MEDIUMNVD
EPSS
0.1%
top 75.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Libvirt
Timeline
PublishedAug 10
Latest updateMay 17

Description

The virSecurityManagerGetPrivateData function in security/security_manager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users to read arbitrary files on the host OS. NOTE: this vulnerability exists because of a CVE-2010-2238 regression.

CVSS vector

AV:L/AC:M/C:C/I:N/A:NExploitability: 2.7 | Impact: 6.9

Affected Packages2 packages

▶Debianredhat/libvirt< 0.9.1-2+3
▶NVDredhat/libvirt0.8.8, 0.9.0, 0.9.1+2

Patches

Patch: bugzilla.redhat.com ↗Patch: www.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-5383-rqrv-fg4g: The virSecurityManagerGetPrivateData function in security/security_manager↗2022-05-17
▶
CVEList
CVE-2011-2178: The virSecurityManagerGetPrivateData function in security/security_manager↗2011-08-10
▶
OSV
CVE-2011-2178: The virSecurityManagerGetPrivateData function in security/security_manager↗2011-08-10
▶

📋Vendor Advisories

3
Ubuntu
libvirt vulnerabilities↗2011-06-16
▶
Red Hat
libvirt: regression introduced in disk probe logic↗2011-05-31
▶
Debian
CVE-2011-2178: libvirt - The virSecurityManagerGetPrivateData function in security/security_manager.c in ...↗2011
▶

💬Community

3
Bugzilla
CVE-2011-2178 libvirt: regression introduced in disk probe logic [fedora-rawhide]↗2011-06-01
▶
Bugzilla
CVE-2011-2178 libvirt: regression introduced in disk probe logic [fedora-15]↗2011-06-01
▶
Bugzilla
CVE-2011-2178 libvirt: regression introduced in disk probe logic↗2011-06-01
▶
CVE-2011-2178 — Redhat Libvirt vulnerability | cvebase