CVE-2010-2239

2010-08-1900:00:00

ubuntu.com

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:S/C:C/I:N/A:N

EPSS

0.001

Percentile

26.5%

JSON

Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without
setting the user-defined backing-store format, which allows guest OS users
to read arbitrary files on the host OS via unspecified vectors.

Notes

Author	Note
jdstrand	AppArmor in Ubuntu 9.10 and 10.04 should protect the host OS, but an attacker in a virtual machine may be able to access files of another machine. Ubuntu 9.10’s qemu-img and kvm-img both support ‘-F backingType’, so hard code libvirt to use this Ubuntu 9.04’s qemu-img and kvm-img do not support specifiying a backing store disk format, so we must autoprobe backing stores at this time. Qemu didn’t gain this option until 0.11, and 9.04 has 0.10 and kvm 84. The changes to qemu/kvm are too invasive and regression-prone and therefore an update will not be provided for this CVE for Ubuntu 9.04.

Author

Note

jdstrand

AppArmor in Ubuntu 9.10 and 10.04 should protect the host OS, but an attacker in a virtual machine may be able to access files of another machine. Ubuntu 9.10’s qemu-img and kvm-img both support ‘-F backingType’, so hard code libvirt to use this Ubuntu 9.04’s qemu-img and kvm-img do not support specifiying a backing store disk format, so we must autoprobe backing stores at this time. Qemu didn’t gain this option until 0.11, and 9.04 has 0.10 and kvm 84. The changes to qemu/kvm are too invasive and regression-prone and therefore an update will not be provided for this CVE for Ubuntu 9.04.

OSVersionArchitecturePackageVersionFilename
ubuntu9.10noarchlibvirt< 0.7.0-1ubuntu13.2UNKNOWN
ubuntu10.04noarchlibvirt< 0.7.5-5ubuntu27.5UNKNOWN
ubuntu10.10noarchlibvirt< 0.8.3-1ubuntu8UNKNOWN