REDHAT-BUG-2415409: Medium severity libvirt libvirt vulnerability
External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.
Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1120119
Upstream patch: https://gitlab.com/libvirt/libvirt/-/commit/a379327d8abcde8ac8d3e16fe5e4ba6f790d767a
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2415409?
The severity of REDHAT-BUG-2415409 is considered high due to potential information disclosure risks.
How do I fix REDHAT-BUG-2415409?
To fix REDHAT-BUG-2415409, you should update the Libvirt package to the latest version that addresses this vulnerability.
Who is affected by REDHAT-BUG-2415409?
Users of Libvirt that have external inactive snapshots for shut-down virtual machines are affected by REDHAT-BUG-2415409.
What are the consequences of REDHAT-BUG-2415409?
The consequences of REDHAT-BUG-2415409 include unauthorized access to the guest OS contents by unprivileged users.
Is REDHAT-BUG-2415409 still being worked on?
Yes, the developers are actively addressing the issues related to REDHAT-BUG-2415409.