CVE-2019-10161: Path Traversal
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
Other sources
It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
It was discovered that libvirtd would permit readonly clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
This vulnerability was first present in libvirt v0.9.4.
— Red Hat
Affected Software
Remediation
Information
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-10161?
CVE-2019-10161 is a vulnerability discovered in libvirtd before versions 4.10.1 and 5.4.1.
What is the severity of CVE-2019-10161?
The severity of CVE-2019-10161 is high with a CVSS score of 8.8.
How does CVE-2019-10161 affect libvirt?
CVE-2019-10161 allows read-only clients to use the virDomainSaveImageGetXMLDesc() API with an arbitrary path, leading to potential privilege escalation.
What is the remedy for CVE-2019-10161?
The remedy for CVE-2019-10161 is to update libvirtd to version 4.10.1 or 5.4.1.
Where can I find more information about CVE-2019-10161?
You can find more information about CVE-2019-10161 at the following references: [link 1](https://access.redhat.com/libvirt-privesc-vulnerabilities), [link 2](https://libvirt.org/git/?p=libvirt.git;a=commit;h=aed6a032cead4386472afb24b16196579e239580), [link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1722463).