CVE-2020-15708 — Incorrect Permission Assignment in Libvirt

CWE-732 — Incorrect Permission Assignment12 documents9 sources
Severity
7.8HIGHNVD
CNA9.3
EPSS
0.2%
top 63.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Ubuntu LibvirtRedhat LibvirtCanonical Ubuntu Linux
Timeline
PublishedNov 6
Latest updateMay 24

Description

Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5ubuntu/libvirtunspecified — 6.0.0-0ubuntu8.3
▶Ubunturedhat/libvirt< 6.0.0-0ubuntu8.3

Also affects: Ubuntu Linux 20.04

🔴Vulnerability Details

3
GHSA
GHSA-6pr6-q53r-2q97: Ubuntu's packaging of libvirt in 20↗2022-05-24
▶
CVEList
Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability↗2020-11-06
▶
OSV
CVE-2020-15708: Ubuntu's packaging of libvirt in 20↗2020-08-04
▶

📋Vendor Advisories

5
Red Hat
libvirt: incorrect permissions on the UNIX domain socket allows local attacker to escalate privileges↗2020-08-04
▶
Ubuntu
libvirt vulnerability↗2020-08-04
▶
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: User Interface (Apache Synapse) — CVE-2017-15708↗2020-07-15
▶
Oracle
Oracle Oracle PeopleSoft Risk Matrix: Portal (Apache Commons) — CVE-2017-15708↗2020-01-15
▶
Debian
CVE-2020-15708: libvirt - Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world r...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-15708 mingw-libvirt: libvirt: incorrect permissions on the UNIX domain socket allows local attacker to escalate privileges [fedora-all]↗2020-08-05
▶
Bugzilla
CVE-2020-15708 libvirt: incorrect permissions on the UNIX domain socket allows local attacker to escalate privileges [fedora-all]↗2020-08-05
▶
Bugzilla
CVE-2020-15708 libvirt: incorrect permissions on the UNIX domain socket allows local attacker to escalate privileges↗2020-08-05
▶