CVE-2019-10132: fedoraproject fedora
CVSS: 8.8v3.0HighModified
AliasesRHSA-2019:1264RHSA-2019:1268UBUNTU-CVE-2019-10132DEBIAN-CVE-2019-10132
Published 22-05-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-10132 is a high (CVSS 8.8) vulnerability in fedoraproject fedora. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 71.5% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.0 (CVE.org)EPSS score
1.37%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 22-05-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 5 agree
- NVDNIST8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.37%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
-0.04 pp
From 1.41% on 19-09-2026
19-09-202619-10-2026
EPSS score1.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Affected systems
Redhat176 products
- libvirt≤ 4.1.0
- hivex< 0:1.3.15-6.module+el8.0.0+3075+09be6b65
- hivex-debuginfo< 0:1.3.15-6.module+el8.0.0+3075+09be6b65
- hivex-debugsource< 0:1.3.15-6.module+el8.0.0+3075+09be6b65
- hivex-devel< 0:1.3.15-6.module+el8.0.0+3075+09be6b65
Debian1 product
- libvirt< 5.0.0-3
Fedoraproject1 product
- fedorana
Libvirt1 product
- libvirtaffects >= 4.1.0
Ubuntu1 product
- libvirt< 1.3.1-1ubuntu10.25 | < 4.0.0-1ubuntu8.9
5 vendors · 180 products
References
18 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10132X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
