Medium severity · published Aug 20, 2018
CVE-2015-5160
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a…
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
5; 6.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
7.3; 7.4; 7.5; 7.6 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.3; 7.4; 7.6 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
7.3; 7.4; 7.5; 7.6 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.3; 7.6 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
LI
Libvirt · Libvirt
before 2.2 · source: NVD
VI
Virtualization · Redhat
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5160
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2577.html
Mailing List
http://www.openwall.com/lists/oss-security/2017/07/21/3
Issue Tracking
https://bugs.launchpad.net/ossn/+bug/1686743
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1245647
Third Party Advisory
https://wiki.openstack.org/wiki/OSSN/OSSN-0079
More from Libvirt
–
CVE-2014-3657
The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial…
–
CVE-2014-3633
The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to…
–
CVE-2010-2242
Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by…
–
CVE-2010-2239
Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the…
–
CVE-2010-2238
Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users…