Improper access control in libvirt (Alpine package)

1) Improper access control

EUVDB-ID: #VU32019

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-10167

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libvirt (Alpine package): 3.9.0-r1 - 5.4.0-r0

CPE2.3

• cpe:2.3:o:alpine:libvirt_alpine_package:3.9.0-r1:*:*:*:*:alpine_linux:*:3.6
• cpe:2.3:o:alpine:libvirt_alpine_package:3.10.0-r0:*:*:*:*:alpine_linux:*:3.7
• cpe:2.3:o:alpine:libvirt_alpine_package:4.0.0-r0:*:*:*:*:alpine_linux:*:3.7

External links

https://git.alpinelinux.org/aports/commit/?id=0a50437d8b8d5a583b96d5807d95e6b549772ba3
https://git.alpinelinux.org/aports/commit/?id=57cb6585ba678d10c85a9ff2a577a280f58922ed
https://git.alpinelinux.org/aports/commit/?id=011b9d5c5ae0af504ab1bb28a042d56676636a00
https://git.alpinelinux.org/aports/commit/?id=8cad441d0bb3d51026cb0231485848ce9a821e6a
https://git.alpinelinux.org/aports/commit/?id=911332961e1fa7187cf3869595066bb18d226e27
https://git.alpinelinux.org/aports/commit/?id=2d0114c907c5b85d78a75d70bd60c5544ed8eedb
https://git.alpinelinux.org/aports/commit/?id=d8c86688b6afbadd18a78b88a430ed4cabe78e7c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.