CVE-2013-4291

2013-09-3021:55:09

CWE-264

redhat

web.nvd.nist.gov

libvirt

cve-2013-4291

virsecuritymanagersetprocesslabel

privilege escalation

nvd

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

8.1

Confidence

High

EPSS

Percentile

5.1%

JSON

The virSecurityManagerSetProcessLabel function in libvirt 0.10.2.7, 1.0.5.5, and 1.1.1, when the domain has read an uid:gid label, does not properly set group memberships, which allows local users to gain privileges.

Affected configurations

Nvd

Node

redhatlibvirtMatch0.10.2.7

redhatlibvirtMatch1.0.5.5

redhatlibvirtMatch1.1.1

VendorProductVersionCPE
redhatlibvirt1.0.5.5cpe:/a:redhat:libvirt:1.0.5.5:::
redhatlibvirt1.1.1cpe:/a:redhat:libvirt:1.1.1:::
redhatlibvirt0.10.2.7cpe:/a:redhat:libvirt:0.10.2.7:::

Vendor	Product	Version	CPE
redhat	libvirt	1.0.5.5	cpe:/a:redhat:libvirt:1.0.5.5:::
redhat	libvirt	1.1.1	cpe:/a:redhat:libvirt:1.1.1:::
redhat	libvirt	0.10.2.7	cpe:/a:redhat:libvirt:0.10.2.7:::