CVE-2010-3851: Infoleak
libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to lack of support for a disk format specifier.
Other sources
Libguestfs doesn't currently allow the format of a disk to be specified explicitly. Because of that malicious guest admin can exploit automatic image format detection in qemu, when the libguestfs is used to administer the image, to read arbitrary file on host via forging a image header with backing store.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3851?
CVE-2010-3851 is classified as a high-severity vulnerability due to the potential for local guest OS administrators to access host files.
How do I fix CVE-2010-3851?
To fix CVE-2010-3851, upgrade libguestfs to version 1.5.23 or later to address the vulnerability.
What systems are affected by CVE-2010-3851?
CVE-2010-3851 affects libguestfs versions prior to 1.5.23, as well as older versions of virt-v2v and virt-inspector.
What types of disk images can trigger CVE-2010-3851?
CVE-2010-3851 can be triggered using raw-format disk images like qcow2, VMDK, or VDI.
Who can exploit CVE-2010-3851?
CVE-2010-3851 can be exploited by local guest OS administrators with access to vulnerable systems.