REDHAT-BUG-2556058: Medium severity Cockpit cockpit-machines vulnerability
A flaw was found in cockpit-machines. Saving VNC console settings passes the configured password through virtXmlEdit() and runVirtXml() into a virt-xml --graphics command-line argument. A local unprivileged attacker on a host permitting cross-user process inspection can read the password while another user saves the settings. Because the dialog also submits an existing password when other settings are changed, changing only the console port can expose the credential again. A disclosed password may allow unauthorized access to a guest's VNC console when the console is active, reachable, and accepts that password. Loopback-only listening does not by itself prevent access by a local attacker.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to capture the VNC password?
The attacker must have local unprivileged access to the host and be able to inspect processes owned by other users. They must observe the host while another user saves the VNC console settings.
Can the password be exposed when an administrator changes a setting other than the password?
Yes. The settings dialog submits the existing password even when another console setting, such as the console port, is changed, which can expose the credential again.
Does binding the VNC console to loopback prevent this issue?
No. Loopback-only listening does not prevent a local attacker from reading the password through cross-user process inspection.
When can a captured password be used to access a guest console?
It may permit unauthorized VNC console access when the guest console is active, reachable, and configured to accept that password.