CVE-2019-10161: canonical ubuntu_linux Improper Access Control
CVSS: 8.8v3.0HighModified
AliasesALPINE-CVE-2019-10161SUSE-SU-2019:14100-1SUSE-SU-2019:1690-1RHSA-2019:1578UBUNTU-CVE-2019-10161USN-4047-2DEBIAN-CVE-2019-10161
Published 30-07-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-10161 is a high (CVSS 8.8) Improper Access Control vulnerability in canonical ubuntu_linux. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.7% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.0 (CVE.org)EPSS score
0.52%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 19 · Related 12DLA-1832-1DSA-4469-1MGASA-2019-0390OPENSUSE-SU-2019:1672-1OPENSUSE-SU-2019:1753-1OPENSUSE-SU-2024:11008-1RHSA-2019:1579RHSA-2019:1580RHSA-2019:1699RHSA-2019:1762SUSE-SU-2019:14097-1SUSE-SU-2019:1599-1SUSE-SU-2019:1637-1SUSE-SU-2019:1643-1SUSE-SU-2019:1686-1SUSE-SU-2019:2105-1SUSE-SU-2019:2227-1SUSE-SU-2019:2227-2USN-4047-1
Timeline
- 30-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
CVSS metrics
9 scores · 6 sources · 3 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 8.8Preferred score · CVE.org (CNA)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSources4 sources · 7.3–8.8
- NVDNIST8.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.3HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
High 7.2Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 19-09-2026
19-09-202619-10-2026
EPSS score0.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Redhat10 products
- enterprise_linuxEOL6.0 | 7.0 | 8.0
- libvirt< 4.10.1 | ≥ 5.0.0, < 5.4.1
- virtualization4.0
- virtualization_host4.0
- libvirt< 0:0.10.2-64.el6_10.2
Suse2 products
- libvirt&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 1.0.5.9-21.20.1
- libvirt&distro=SUSE Linux Enterprise Server 12-LTSS< 1.2.5-27.19.1
Alpine1 product
- libvirt≥ 5.0.0, < 5.5.0-r0
Canonical1 product
- ubuntu_linuxEOL14.04
Debian1 product
- libvirt< 5.0.0-4
Libvirt1 product
- libvirtfixed in 4.10.1 | fixed in 5.4.1
Ubuntu1 product
- libvirt< 1.3.1-1ubuntu10.27 | < 4.0.0-1ubuntu8.12 | < 1.2.2-0ubuntu13.1.28+esm1
7 vendors · 17 products
References
23 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- access.redhat.com/libvirt-privesc-vulnerabilitiesX Refsource CONFIRMThird Party AdvisoryARTICLEREPORT
