Critical Vulnerability in libvirt: Arbitrary Code Execution Risk
Summary
ALPINE-CVE-2019-10167: The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Affects libvirt versions < 5.5.0-r0. Fixed in 5.5.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvirt is an open-source API, daemon, and management tool for managing platform virtualization. It provides a consistent way to interact with various virtualization technologies, allowing users to manage virtual machines, storage, and networks. The libvirt library is widely used in cloud computing and virtualization environments. However, it has been found to have a critical vulnerability that can lead to arbitrary code execution if exploited.
Vulnerability Detail
The virConnectGetDomainCapabilities() API in libvirt, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an 'emulatorbin' argument that specifies the program providing emulation for a domain. Since version 1.2.19, libvirt executes this program to probe the domain's capabilities. This allows read-only clients to specify an arbitrary path for this argument, which can lead to the execution of a crafted executable with the privileges of the libvirtd process. This vulnerability poses a significant risk as it can be exploited to execute malicious code on the host system.
How To Fix
Minimum fixed version
5.5.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the libvirt API to trusted users only. This can be done by configuring the appropriate permissions and ensuring that only authorized clients can interact with the libvirt daemon.
Conclusion
The libvirt vulnerability identified as CVE-2019-10167 poses a significant risk due to its potential for arbitrary code execution. It is crucial for users to update to the patched version 5.5.0-r0 or later to safeguard their systems. Additionally, implementing access restrictions can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for libvirt →
FAQ
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
libvirt versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to arbitrary code execution on the host system, potentially compromising the entire virtualization environment.
Yes, you can mitigate the risk by restricting access to the libvirt API to only trusted users and clients.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
