CVE-2019-10166

NameCVE-2019-10166
DescriptionIt was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libvirt (PTS)jessie1.2.9-9+deb8u5fixed
jessie (security)1.2.9-9+deb8u7fixed
stretch (security), stretch3.0.0-4+deb9u4fixed
buster5.0.0-4+deb10u1fixed
bullseye5.6.0-2fixed
sid5.6.0-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libvirtsource(unstable)5.0.0-4
libvirtsourcejessie(not affected)
libvirtsourcestretch(not affected)

Notes

[stretch] - libvirt <not-affected> (Vulnerable code introduced in 3.6.1)
[jessie] - libvirt <not-affected> (Vulnerable code introduced in 3.6.1)
https://access.redhat.com/libvirt-privesc-vulnerabilities
https://bugzilla.redhat.com/show_bug.cgi?id=1720114
https://libvirt.org/git/?p=libvirt.git;a=commit;h=db0b78457f183e4c7ac45bc94de86044a1e2056a

Search for package or bug name: Reporting problems