CVE-2019-10167 The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since...
HighCVSS 7.8
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libvirt(Debian:12) | < 5.0.0-4 | 5.0.0-4 |
| debian/libvirt(Debian:13) | < 5.0.0-4 | 5.0.0-4 |
| debian/libvirt(Debian:14) | < 5.0.0-4 | 5.0.0-4 |
| redhat libvirt | >= 4.0.0, < 4.10.1 | 4.10.1 |
| redhat libvirt | >= 5.0.0, < 5.4.1 | 5.4.1 |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux | = 8.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| redhat virtualization | = 4.3 | No fix listed |
| alpine/libvirt(Alpine:v3.10) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.11) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.12) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.13) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.14) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.15) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.16) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.17) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/libvirt(Alpine:v3.18) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.19) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.20) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.21) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.22) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.23) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.24) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.7) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.8) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| alpine/libvirt(Alpine:v3.9) | >= 4.0.0, < 5.5.0-r0 | 5.5.0-r0 |
| libvirt | = 4.x.x before 4.10.1 | No fix listed |
| libvirt | = 5.x.x before 5.4.1 | No fix listed |
References
- Debian Security Tracker CVE-2019-10167 vendor-advisory
- access.redhat.com vendor-advisory
- bugzilla.redhat.com issue-tracking vendor-advisory
- GLSA-202003-18 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory