Login Request a demo
Unscored severity · published Aug 19, 2010
CVE-2010-2238
Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users…
–
CVSS
0.3%
EPSS
No
On KEV
Description
Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libvirt · Libvirt
0.7.2; 0.7.3; 0.7.4; 0.7.5; 0.7.6; 0.7.7; +3 more · source: NVD
Affected product
LI
Libvirt
Libvirt
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2238
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2238
Vendor Advisory
http://libvirt.org/news.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
ubuntu.com
http://ubuntu.com/usn/usn-1008-1
ubuntu.com
http://ubuntu.com/usn/usn-1008-2
More from Libvirt
5.5
CVE-2015-5160
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a…
–
CVE-2014-3657
The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial…
–
CVE-2014-3633
The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to…
–
CVE-2010-2242
Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by…
–
CVE-2010-2239
Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the…