CVE-2019-10161
📋 TL;DR
This vulnerability in libvirtd allows read-only clients to access arbitrary files and execute programs with libvirtd's permissions via the virDomainSaveImageGetXMLDesc() API. Systems running libvirtd before versions 4.10.1 or 5.4.1 are affected. Attackers with access to the libvirtd socket can probe files, cause denial of service, or execute arbitrary code.
💻 Affected Systems
- libvirt
- libvirtd
📦 What is this software?
Libvirt by Redhat
Libvirt by Redhat
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with libvirtd privileges leading to full system compromise.
Likely Case
Information disclosure of sensitive files or denial of service through resource exhaustion.
If Mitigated
Limited impact if libvirtd socket access is restricted to trusted users only.
🎯 Exploit Status
Exploitation requires socket access but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libvirt 4.10.1 or 5.4.1
Vendor Advisory: https://access.redhat.com/libvirt-privesc-vulnerabilities
Restart Required: Yes
Instructions:
1. Update libvirt package to version 4.10.1 or 5.4.1 or higher. 2. Restart libvirtd service. 3. Verify the patch is applied.
🔧 Temporary Workarounds
Restrict socket access
linuxLimit access to libvirtd socket to trusted users only
chmod 660 /var/run/libvirt/libvirt-sock
chown root:libvirt /var/run/libvirt/libvirt-sock
Disable read-only socket
linuxRemove or disable read-only socket if not needed
systemctl stop libvirtd-ro.socket
systemctl disable libvirtd-ro.socket
🧯 If You Can't Patch
- Restrict libvirtd socket permissions to root and libvirt group only
- Monitor libvirtd logs for suspicious API calls to virDomainSaveImageGetXMLDesc()
🔍 How to Verify
Check if Vulnerable:
Check libvirt version: libvirtd --version | grep -E '4\.([0-9]|10\.0)|5\.([0-3]|4\.0)'Check Version:
libvirtd --versionVerify Fix Applied:
Verify version is 4.10.1+ or 5.4.1+: libvirtd --version📡 Detection & Monitoring
Log Indicators:
- Unusual virDomainSaveImageGetXMLDesc() API calls
- Access to unexpected file paths in libvirtd logs
Network Indicators:
- Unexpected connections to libvirtd socket
SIEM Query:
source="libvirtd" AND "virDomainSaveImageGetXMLDesc"🔗 References
- https://access.redhat.com/libvirt-privesc-vulnerabilities
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161
- https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=aed6a032cead4386472afb24b16196579e239580
- https://security.gentoo.org/glsa/202003-18
- https://usn.ubuntu.com/4047-2/
- https://access.redhat.com/libvirt-privesc-vulnerabilities
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161
- https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=aed6a032cead4386472afb24b16196579e239580
- https://security.gentoo.org/glsa/202003-18
- https://usn.ubuntu.com/4047-2/
