CVE-2019-3886 — Missing Authorization in Redhat Libvirt

CWE-862 — Missing AuthorizationCWE-648 — Incorrect Use of Privileged APIs13 documents9 sources
Severity
5.4MEDIUMNVD
EPSS
0.5%
top 35.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Redhat LibvirtTHE Libvirt Project LibvirtFedoraproject Fedora+1 more
Timeline
PublishedApr 4
Latest updateMay 13

Description

An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:LExploitability: 2.8 | Impact: 2.5

Affected Packages4 packages

▶NVDredhat/libvirt4.8.0 — 5.3.0
▶Debianredhat/libvirt< 5.0.0-2+3
▶CVEListV5the_libvirt_project/libvirt4.8.0 and above
▶NVDopensuse/leap42.3

Also affects: Fedora 29, 30

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-wxvx-hq9w-75x9: An incorrect permissions check was discovered in libvirt 4↗2022-05-13
▶
CVEList
CVE-2019-3886: An incorrect permissions check was discovered in libvirt 4↗2019-04-04
▶
OSV
CVE-2019-3886: An incorrect permissions check was discovered in libvirt 4↗2019-04-04
▶

📋Vendor Advisories

5
Ubuntu
libvirt vulnerabilities↗2019-06-19
▶
Red Hat
libvirt: libvirt-domain.c supports virDomainGetTime API calls with an RO connection instead of RW connection↗2019-04-18
▶
Microsoft
An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent which could lead to potentially disclosing uni↗2019-04-09
▶
Red Hat
libvirt: virsh domhostname command discloses guest hostname in readonly mode↗2019-04-03
▶
Debian
CVE-2019-3886: libvirt - An incorrect permissions check was discovered in libvirt 4.8.0 and above. The re...↗2019
▶

💬Community

4
Bugzilla
CVE-2019-15785 fontforge: buffer overflow in PrefsUI_LoadPrefs in prefs.c↗2019-09-11
▶
Bugzilla
CVE-2019-3886 libvirt: virsh domhostname command discloses guest hostname in readonly mode [fedora-rawhide]↗2019-04-04
▶
Bugzilla
CVE-2019-3886 mingw-libvirt: libvirt: virsh domhostname command discloses guest hostname in readonly mode [fedora-rawhide]↗2019-04-04
▶
Bugzilla
CVE-2019-3886 libvirt: virsh domhostname command discloses guest hostname in readonly mode↗2019-04-01
▶
CVE-2019-3886 — Missing Authorization in Redhat Libvirt | cvebase