CVE-2019-10132

CWE-732 — Incorrect Permission AssignmentCWE-26410 documents8 sources
Severity
8.8HIGH
EPSS
1.3%
top 20.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat LibvirtLibvirt Libvirt
Timeline
PublishedMay 22
Latest updateMay 24

Description

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages3 packages

▶Debianlibvirt< 5.0.0-3+3
▶NVDredhat/libvirt4.1.0
▶CVEListV5libvirt/libvirtaffects >= 4.1.0

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-gf34-qgv2-76mf: A vulnerability was found in libvirt >= 4↗2022-05-24
▶
CVEList
CVE-2019-10132: A vulnerability was found in libvirt >= 4↗2019-05-22
▶
OSV
CVE-2019-10132: A vulnerability was found in libvirt >= 4↗2019-05-22
▶

📋Vendor Advisories

3
Ubuntu
libvirt vulnerabilities↗2019-06-19
▶
Red Hat
libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter↗2019-05-21
▶
Debian
CVE-2019-10132: libvirt - A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and ...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-10132 libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter [fedora-all]↗2019-05-21
▶
Bugzilla
CVE-2019-10132 mingw-libvirt: libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter [fedora-all]↗2019-05-21
▶
Bugzilla
CVE-2019-10132 libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter↗2019-05-03
▶