CVE-2011-4316: Low severity red hat enterprise virtualization manager vulnerability
It was found that under certain conditions, SPICE would fail to lock the screen on a virtual machine between sessions. A user with access to a virtual machine in the Red Hat Enterprise Virtualization Manager could exploit this flaw to gain access to another user's unlocked desktop session. This is a security concern in environments where multiple users have access to the same virtual machine, but they use different operating system credentials to log on to that virtual machine.
Other sources
Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4316?
CVE-2011-4316 is classified as a medium severity vulnerability.
How do I fix CVE-2011-4316?
To fix CVE-2011-4316, you should update the affected Red Hat Enterprise Virtualization Manager to the latest version available.
Who is affected by CVE-2011-4316?
CVE-2011-4316 affects users of Red Hat Enterprise Virtualization Manager versions up to 3.0 and versions 2.1, 2.2, and 2.2.3.
What kind of exploitation is possible with CVE-2011-4316?
Exploitation of CVE-2011-4316 could allow an unauthorized user to access another user's unlocked desktop session on a virtual machine.
When was CVE-2011-4316 published?
CVE-2011-4316 was published in late 2011.