CVE-2019-10132: High severity redhat libvirt vulnerability
A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-10132.
What is the severity of CVE-2019-10132?
The severity of CVE-2019-10132 is high with a severity value of 8.8.
What is the affected software for CVE-2019-10132?
The affected software for CVE-2019-10132 includes Redhat Libvirt (up to version 4.1.0), Fedoraproject Fedora, Ubuntu (versions 4.6.0-2ubuntu3.7 and 5.0.0-1ubuntu2.3), and Debian (versions 5.0.0-4+deb10u1, 7.0.0-3+deb11u2, 9.0.0-4, and 9.8.0-2).
What is the description of CVE-2019-10132?
CVE-2019-10132 is a vulnerability in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units, allowing any user on the host to perform administrative tasks against the virtlockd and virtlogd services.
How can I mitigate CVE-2019-10132?
To mitigate CVE-2019-10132, ensure that the SocketMode configuration parameter is properly set in the virtlockd-admin.socket and virtlogd-admin.socket systemd units.