CVE-2019-10166

Name of the Vulnerable Software and Affected Versions libvirtd versions 4.x.x through 4.10.0 libvirtd versions 5.x.x through 5.4.0

Description The issue is related to insufficient access control in the virDomainManagedSaveDefineXML() API, allowing readonly clients to modify managed save state files. If a managed save was created by a privileged user, a local attacker could modify this file to execute an arbitrary program when the domain is resumed. This could potentially allow an attacker to change arbitrary files by sending a specially crafted request.

Recommendations For libvirtd versions 4.x.x through 4.10.0, update to version 4.10.1 or later. For libvirtd versions 5.x.x through 5.4.0, update to version 5.4.1 or later. As a temporary workaround, consider restricting access to the virDomainManagedSaveDefineXML() API until a patch is available.