Main Vulnerability Database Vulnerabilities #VU42985

Permissions, Privileges, and Access Controls in libvirt - CVE-2013-1766

Published: March 20, 2013 / Updated: August 11, 2020

Vulnerability identifier: #VU42985

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-1766

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.

libvirt

Install update from vendor's website.