CVE-2019-10167
published 2019-08-02CVE-2019-10167: The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.52%
40.8th percentile
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libvirt | < libvirt 5.0.0-4 (bookworm) | libvirt 5.0.0-4 (bookworm) |
| libvirt | libvirt | — | — |
| libvirt | libvirt | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | libvirt | >= 0 < 5.0.0-4 | 5.0.0-4 |
| redhat | libvirt | >= 0 < 5.0.0-4 | 5.0.0-4 |
| redhat | libvirt | >= 0 < 5.0.0-4 | 5.0.0-4 |
| redhat | libvirt | >= 0 < 5.0.0-4 | 5.0.0-4 |
| redhat | libvirt | >= 4.0.0 < 4.10.1 | 4.10.1 |
| redhat | libvirt | >= 5.0.0 < 5.4.1 | 5.4.1 |
| redhat | virtualization | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libvirt vulnerabilities
vendor_ubuntu·2019-07-08
CVE-2019-10161 libvirt vulnerabilities
Title: libvirt vulnerabilities
Summary: Several security issues were fixed in libvirt.
Matthias Gerstner and Ján Tomko discovered that libvirt incorrectly handled
certain API calls. An attacker could possibly use this issue to check for
arbitrary files, or execute arbitrary binaries. In the default
installation, attackers would be isolated by the libvirt AppArmor profile.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
libvirt: arbitrary command execution via virConnectGetDomainCapabilities API
vendor_redhat·2019-06-20·CVSS 7.8
CVE-2019-10167 [HIGH] CWE-829 libvirt: arbitrary command execution via virConnectGetDomainCapabilities API
libvirt: arbitrary command execution via virConnectGetDomainCapabilities API
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
The virConnectGetDomainCapabilities() libvirt API accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, cau
Debian
CVE-2019-10167: libvirt - The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 ...
vendor_debian·2019·CVSS 7.8
CVE-2019-10167 [HIGH] CVE-2019-10167: libvirt - The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 ...
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
Scope: local
bookworm: resolved (fixed in 5.0.0-4)
bullseye: resolved (fixed in 5.0.0-4)
forky: resolved (fixed in 5.0.0-4)
sid: resolved (fixed in 5.0.0-4)
trixie: resolved (fixed in 5.0.0-4)
GHSA
GHSA-5p5j-3wqp-w634: The virConnectGetDomainCapabilities() libvirt API, versions 4
ghsa_unreviewed·2022-05-24
CVE-2019-10167 [HIGH] CWE-22 GHSA-5p5j-3wqp-w634: The virConnectGetDomainCapabilities() libvirt API, versions 4
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
OSV
CVE-2019-10167: The virConnectGetDomainCapabilities() libvirt API, versions 4
osv·2019-08-02·CVSS 7.8
CVE-2019-10167 [HIGH] CVE-2019-10167: The virConnectGetDomainCapabilities() libvirt API, versions 4
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-10167 libvirt: arbitrary command execution via virConnectGetDomainCapabilities API [fedora-all]
bugzilla·2019-06-20·CVSS 7.8
CVE-2019-10167 [HIGH] CVE-2019-10167 libvirt: arbitrary command execution via virConnectGetDomainCapabilities API [fedora-all]
CVE-2019-10167 libvirt: arbitrary command execution via virConnectGetDomainCapabilities API [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-10167 mingw-libvirt: libvirt: arbitrary command execution via virConnectGetDomainCapabilities API [fedora-all]
bugzilla·2019-06-20·CVSS 7.8
CVE-2019-10167 [HIGH] CVE-2019-10167 mingw-libvirt: libvirt: arbitrary command execution via virConnectGetDomainCapabilities API [fedora-all]
CVE-2019-10167 mingw-libvirt: libvirt: arbitrary command execution via virConnectGetDomainCapabilities API [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this
Bugzilla
CVE-2019-10167 libvirt: arbitrary command execution via virConnectGetDomainCapabilities API
bugzilla·2019-06-13·CVSS 7.8
CVE-2019-10167 [HIGH] CVE-2019-10167 libvirt: arbitrary command execution via virConnectGetDomainCapabilities API
CVE-2019-10167 libvirt: arbitrary command execution via virConnectGetDomainCapabilities API
The virConnectGetDomainCapabilities() libvirt API accepts an "emulatorbin"
argument to specify the program providing emulation for a domain. Since
v1.2.19, libvirt will execute that program to probe the domain's
capabilities. Read-only clients could specify an arbitrary path for this
argument, causing libvirtd to execute a crafted executable with its own
privileges.
Discussion:
Acknowledgments:
Name: Jan Tomko (Red Hat)
---
Statement:
* This vulnerability requires access to the libvirt socket, normally in /var/run/libvirt/libvirt_sock_ro. Typically in hypervisor environments, local user accounts are not supported so no untrusted users should be able to access this socket.
* Red Hat Gluster St
https://access.redhat.com/libvirt-privesc-vulnerabilitieshttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10167https://security.gentoo.org/glsa/202003-18https://access.redhat.com/libvirt-privesc-vulnerabilitieshttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10167https://security.gentoo.org/glsa/202003-18
2019-08-02
Published