CVE-2020-15708
📋 TL;DR
Ubuntu 20.04 LTS's libvirt package created a control socket with overly permissive world read/write permissions. This allows local attackers to overwrite arbitrary files or execute arbitrary code by writing to the socket. Only Ubuntu 20.04 LTS systems with libvirt installed are affected.
💻 Affected Systems
- libvirt
📦 What is this software?
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution as root, potentially leading to data theft, ransomware deployment, or persistent backdoors.
Likely Case
Local privilege escalation to root, allowing attackers to modify system files, install malware, or access sensitive data.
If Mitigated
No impact if proper file permissions are enforced or the vulnerability is patched.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability is simple to exploit once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libvirt 6.0.0-0ubuntu8.3 and later
Vendor Advisory: https://usn.ubuntu.com/usn/usn-4452-1
Restart Required: Yes
Instructions:
1. Update system: sudo apt update && sudo apt upgrade libvirt-daemon-system libvirt-clients. 2. Restart libvirt services: sudo systemctl restart libvirtd. 3. Verify socket permissions are corrected.
🔧 Temporary Workarounds
Manually fix socket permissions
linuxChange permissions on the libvirt control socket to remove world write access.
sudo chmod o-w /var/run/libvirt/libvirt-sock
🧯 If You Can't Patch
- Restrict local user access to prevent unauthorized users from exploiting the vulnerability.
- Monitor for suspicious activity related to libvirt socket access or privilege escalation attempts.
🔍 How to Verify
Check if Vulnerable:
Check socket permissions: ls -la /var/run/libvirt/libvirt-sock. If world-writable (permissions include 'w' for others), the system is vulnerable.Check Version:
dpkg -l | grep libvirt-daemon-systemVerify Fix Applied:
Verify socket permissions: ls -la /var/run/libvirt/libvirt-sock should show permissions like 'srwxr-xr-x' (no 'w' for others).📡 Detection & Monitoring
Log Indicators:
- Unusual access to /var/run/libvirt/libvirt-sock in audit logs
- Privilege escalation attempts via libvirt
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
source="audit.log" AND path="/var/run/libvirt/libvirt-sock" AND action="write"