PublicDateAtUSN: 2019-06-20
Candidate: CVE-2019-10161
PublicDate: 2019-07-30 23:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10161
 https://rhn.redhat.com/errata/RHSA-2019-1578.html
 https://access.redhat.com/libvirt-privesc-vulnerabilities
 https://security.libvirt.org/2019/0004.html
 https://ubuntu.com/security/notices/USN-4047-1
 https://ubuntu.com/security/notices/USN-4047-2
Description:
 It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would
 permit read-only clients to use the virDomainSaveImageGetXMLDesc() API,
 specifying an arbitrary path which would be accessed with the permissions
 of the libvirtd process. An attacker with access to the libvirtd socket
 could use this to probe the existence of arbitrary files, cause denial of
 service or cause libvirtd to execute arbitrary programs.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Matthias Gerstner
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]


Patches_libvirt:
 upstream: https://libvirt.org/git/?p=libvirt.git;a=commit;h=aed6a032cead4386472afb24b16196579e239580 (5.4)
 upstream: http://libvirt.org/git/?p=libvirt.git;a=commit;h=6aa0c85be9f840a32fcec282185b5ed2513a3aa5 (5.0)
 upstream: http://libvirt.org/git/?p=libvirt.git;a=commit;h=a27659643b8ae9b26b52fc857cdc5b301184e26e (4.6)
 upstream: http://libvirt.org/git/?p=libvirt.git;a=commit;h=1f8129c5db3952a57900b8cd1d94e629068e6aa5 (4.1)
 upstream: http://libvirt.org/git/?p=libvirt.git;a=commit;h=980109c41c8bb55fd105809f2e063667721feaea (1.3.1)
upstream_libvirt: needs-triage
precise/esm_libvirt: ignored (end of ESM support, was needs-triage)
trusty_libvirt: ignored (out of standard support)
trusty/esm_libvirt: released (1.2.2-0ubuntu13.1.28+esm1)
xenial_libvirt: released (1.3.1-1ubuntu10.27)
esm-infra/xenial_libvirt: released (1.3.1-1ubuntu10.27)
bionic_libvirt: released (4.0.0-1ubuntu8.12)
cosmic_libvirt: released (4.6.0-2ubuntu3.8)
disco_libvirt: released (5.0.0-1ubuntu2.4)
eoan_libvirt: released (5.4.0-0ubuntu3)
focal_libvirt: released (5.4.0-0ubuntu3)
groovy_libvirt: released (5.4.0-0ubuntu3)
hirsute_libvirt: released (5.4.0-0ubuntu3)
devel_libvirt: released (5.4.0-0ubuntu3)