CVE-2020-15708: Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability
A vulnerability was found in libvirt, where an incorrect permissions on the UNIX domain socket. A local attacker could use this issue to access libvirt and escalate privileges.
References: https://bugs.mageia.org/27038
Other sources
Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15708?
CVE-2020-15708 is considered a high-severity vulnerability due to the potential for privilege escalation by a local attacker.
How do I fix CVE-2020-15708?
To fix CVE-2020-15708, ensure that libvirt is updated to a fixed version as specified in the security advisories.
What systems are affected by CVE-2020-15708?
CVE-2020-15708 affects libvirt versions in certain Debian and Ubuntu distributions.
Can CVE-2020-15708 be exploited remotely?
CVE-2020-15708 cannot be exploited remotely as it requires local access to the system.
What is the nature of the vulnerability described in CVE-2020-15708?
The nature of CVE-2020-15708 involves incorrect permissions on the UNIX domain socket, allowing unauthorized access to libvirt.