CVE-2019-10167CWE-250CWE-284

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the…

High · published August 2, 2019

CVSS v3.0
8.8
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.1th percentile
Weaknesses
CWE-250 · Execution with Unnecessary Privileges; CWE-284 · Improper Access Control
Published
2019-08-02T12:05Z
EPSS history
Timeline
  • 02 AUG 12:05Z
    The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the…
    cvelistv5