Critical Vulnerability in libvirt: Unauthorized Modification of Managed Save State Files
Summary
ALPINE-CVE-2019-10166: It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state fil... Affects libvirt versions < 5.5.0-r0. Fixed in 5.5.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvirt is an open-source API, daemon, and management tool for managing platform virtualization. It provides a consistent way to interact with various virtualization technologies, allowing users to create, manage, and monitor virtual machines. The libvirt package is widely used in cloud computing and virtualization environments. However, it has been found to have a critical vulnerability that allows unauthorized access to managed save state files, potentially leading to arbitrary code execution.
Vulnerability Detail
The vulnerability identified as CVE-2019-10166 affects libvirtd versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1. It allows read-only clients to use the virDomainManagedSaveDefineXML() API, which should be restricted to privileged users. This flaw can be exploited by local attackers to modify managed save state files created by privileged users. If successful, the attacker could manipulate the file such that libvirtd executes arbitrary programs upon domain resumption, leading to severe security breaches.
How To Fix
Minimum fixed version
5.5.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the virDomainManagedSaveDefineXML() API by ensuring that only privileged users can invoke it. Additionally, consider implementing strict file permissions on managed save state files to mitigate unauthorized access.
Conclusion
CVE-2019-10166 is a critical vulnerability in the libvirt package that poses significant security risks by allowing unauthorized modification of managed save state files. It is crucial to update to the patched version to mitigate these risks and ensure the security of your virtualization environment.
See every vulnerability recorded for libvirt →
FAQ
CVE-2019-10166 is a critical vulnerability in the libvirt package that allows unauthorized modification of managed save state files by read-only clients.
If exploited, this vulnerability could allow local attackers to execute arbitrary code on the host system, leading to severe security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-10166 is 7.8, indicating a high severity level.
The best way to protect your system is to update the libvirt package to version 5.5.0-r0 or later. Additionally, implement strict access controls and file permissions.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
