CVE-2019-10168CWE-250CWE-284

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator"…

High · published August 2, 2019

CVSS v3.0
8.8
EPSS
1%
Percentile
44.9
In the wild
Unconfirmed
What it is

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00549 · 44.9th percentile
Weaknesses
CWE-250 · Execution with Unnecessary Privileges; CWE-284 · Improper Access Control
Published
2019-08-02T12:08Z
EPSS history
Timeline
  • 02 AUG 12:08Z
    The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator"…
    cvelistv5