Security Advisory

CVE-2019-10168

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2019-08-02 12:08:14

Last updated 2024-08-04 22:10:10

Assigner redhat

CVSS score 8.8

State PUBLISHED

Description

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

← Browse all CVEs View on cve.org ↗