CVE-2013-4401 — Redhat Libvirt vulnerability

CWE-2648 documents8 sources
Severity
8.5HIGHNVD
EPSS
1.5%
top 19.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Libvirt
Timeline
PublishedNov 2
Latest updateMay 17

Description

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 6.8 | Impact: 10.0

Affected Packages2 packages

▶Debianredhat/libvirt< 1.1.4-1+3
▶NVDredhat/libvirt4 versions+3

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-p6vr-89w4-8gh3: The virConnectDomainXMLToNative API function in libvirt 1↗2022-05-17
▶
CVEList
CVE-2013-4401: The virConnectDomainXMLToNative API function in libvirt 1↗2013-11-02
▶
OSV
CVE-2013-4401: The virConnectDomainXMLToNative API function in libvirt 1↗2013-11-02
▶

📋Vendor Advisories

3
Ubuntu
libvirt vulnerability↗2013-11-11
▶
Red Hat
libvirt: unintended API access due to incorrect permissions checks↗2013-10-21
▶
Debian
CVE-2013-4401: libvirt - The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 chec...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-4401 libvirt: unintended API access due to incorrect permissions checks↗2013-10-03
▶
CVE-2013-4401 — Redhat Libvirt vulnerability | cvebase