CVE-2015-5247 — Improper Access Control in Redhat Libvirt

CWE-284 — Improper Access Control8 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 34.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat LibvirtCanonical Ubuntu Linux
Timeline
PublishedApr 14
Latest updateMay 17

Description

The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Debianredhat/libvirt< 1.2.20-1+3
▶NVDredhat/libvirt6 versions+5

Also affects: Ubuntu Linux 12.04, 14.04, 15.04, 15.10

🔴Vulnerability Details

3
GHSA
GHSA-xq4r-xr6r-76qw: The virStorageVolCreateXML API in libvirt 1↗2022-05-17
▶
CVEList
CVE-2015-5247: The virStorageVolCreateXML API in libvirt 1↗2016-04-14
▶
OSV
CVE-2015-5247: The virStorageVolCreateXML API in libvirt 1↗2016-04-14
▶

📋Vendor Advisories

3
Ubuntu
libvirt vulnerabilities↗2016-01-12
▶
Red Hat
libvirt: denial of service when volume creation fails on NFS pool↗2015-09-03
▶
Debian
CVE-2015-5247: libvirt - The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote au...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-5247 libvirt: denial of service when volume creation fails on NFS pool↗2015-09-02
▶
CVE-2015-5247 — Improper Access Control in Redhat | cvebase