CVE-2010-2239: Medium severity oracle libvirt vulnerability
It was found that libvirt did not explicitly set the user defined backing store format when creating new image. This results in images being created with an potentialy insecure configuration, preventing applications from opening backing stores without resorting to probing. A priviledged guest user could use this flaw to access arbitrary files on the host.
Other sources
Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2239?
CVE-2010-2239 has a moderate severity rating due to the potential for insecure image configurations in libvirt.
How do I fix CVE-2010-2239?
To fix CVE-2010-2239, you should upgrade your libvirt installation to a version above 0.8.2 that explicitly sets the backing store format.
What versions of libvirt are affected by CVE-2010-2239?
CVE-2010-2239 affects libvirt versions from 0.6.0 to 0.8.2.
Can CVE-2010-2239 be exploited by a guest user?
Yes, a privileged guest user may exploit CVE-2010-2239 to create images in an insecure manner.
What potential risks does CVE-2010-2239 pose to my virtual environment?
CVE-2010-2239 can lead to security liabilities where applications cannot reliably open backing stores due to the insecure configuration.