high 8.8

CVE-2019-10161 json

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() A…

published 2019-07-30 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-2194

cvss: 8.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits: 0; none known

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

Patch / fix

fixed in 1 distros 6 links 1

redhat libvirt 4.10.1, 5.4.1

debian ubuntu red hat suse opensuse alpine

libvirt Debian 14, Debian 13, Debian 12 5.0.0-4

debian advisories DEBIAN-CVE-2019-10161

libvirt Ubuntu 16.04 LTS 1.3.1-1ubuntu10.27
libvirt Ubuntu 18.04 LTS 4.0.0-1ubuntu8.12
libvirt Ubuntu Pro 14.04 LTS 1.2.2-0ubuntu13.1.28+esm1

ubuntu advisories UBUNTU-CVE-2019-10161

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

libvirt RHEL 6 0.10.2-64.el6_10.2
libvirt-client RHEL 6 0.10.2-64.el6_10.2
libvirt-python RHEL 6 0.10.2-64.el6_10.2
libvirt-lock-sanlock RHEL 6 0.10.2-64.el6_10.2
SLOF RHEL 8 20171214-5.gitfa98132.module+el8.0.0.z+3418+a72cf898
hivex RHEL 8 1.3.15-6.module+el8.0.0.z+3418+a72cf898
netcf RHEL 8 0.2.8-10.module+el8.0.0.z+3418+a72cf898
nbdkit RHEL 8 1.4.2-4.module+el8.0.0.z+3418+a72cf898

red hat advisories RHSA-2019:1578 RHSA-2019:1580 RHSA-2019:1699 RHSA-2019:1579 RHSA-2019:1762

libvirt SLES 12 SP3-BCL, OpenStack Cloud Crowbar 8, OpenStack Cloud 8 +4 more 3.3.0-5.40.1
libvirt SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 2.0.0-27.61.1
libvirt SLE Module for Server Applications 15 SP1, SLE Module for Basesystem 15 SP1 5.1.0-8.6.1
libvirt SLE Module for Server Applications 15, SLE Module for Basesystem 15 4.0.0-9.27.1
libvirt SLE Point of Sale 11 SP3 1.0.5.9-21.20.1
libvirt SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 +1 more 4.0.0-8.15.2
libvirt SLES 12-LTSS 1.2.5-27.19.1
libvirt SLES for SAP 12 SP1, SLES 12 SP1-LTSS 1.2.18.4-22.13.1

suse advisories SUSE-SU-2019:2227-1 SUSE-SU-2019:2227-2 SUSE-SU-2019:2105-1 SUSE-SU-2019:1690-1 SUSE-SU-2019:1686-1 SUSE-SU-2019:1643-1

libvirt openSUSE Tumbleweed 7.7.0-2.1
libvirt openSUSE Leap 15.1 5.1.0-lp151.7.3.1
libvirt openSUSE Leap 15.0 4.0.0-lp150.7.18.2

opensuse advisories openSUSE-SU-2024:11008-1 openSUSE-SU-2019:1753-1 openSUSE-SU-2019:1672-1

libvirt Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 5.5.0-r0

alpine advisories ALPINE-CVE-2019-10161

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10161 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10161 updated 2026-11-04 cvss 8.8

libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API

Red Hat Enterprise Linux 8 Advanced Virtualization hivex 1.3.15-6.module+el8.0.0.z+3438+2851622e, nbdkit 1.4.2-4.module+el8.0.0.z+3438+2851622e, netcf 0.2.8-10.module+el8.0.0.z+3438+2851622e, seabios 1.12.0-1.module+el8.0.0.z+3438+2851622e, libiscsi 1.18.0-6.module+el8.0.0.z+3438+2851622e, libssh2 1.8.0-7.module+el8.0.0.z+3438+2851622e.1, +83 more
fixed: vendor fix RHSA-2019:1762
Red Hat Enterprise Linux AppStream (v. 8) hivex 1.3.15-6.module+el8.0.0.z+3418+a72cf898, nbdkit 1.4.2-4.module+el8.0.0.z+3418+a72cf898, netcf 0.2.8-10.module+el8.0.0.z+3418+a72cf898, seabios 1.11.1-3.module+el8.0.0.z+3418+a72cf898, libiscsi 1.18.0-6.module+el8.0.0.z+3418+a72cf898, libssh2 1.8.0-7.module+el8.0.0.z+3418+a72cf898.1, +82 more
fixed: vendor fix RHSA-2019:1580
Red Hat Enterprise Linux Client (v. 7) libvirt 4.5.0-10.el7_6.12, libvirt-libs 4.5.0-10.el7_6.12, libvirt-client 4.5.0-10.el7_6.12, libvirt-daemon 4.5.0-10.el7_6.12, libvirt-daemon-kvm 4.5.0-10.el7_6.12, libvirt-bash-completion 4.5.0-10.el7_6.12, +18 more Red Hat Enterprise Linux Client Optional (v. 7) libvirt-nss 4.5.0-10.el7_6.12, libvirt-admin 4.5.0-10.el7_6.12, libvirt-daemon-lxc 4.5.0-10.el7_6.12, libvirt-login-shell 4.5.0-10.el7_6.12, libvirt-lock-sanlock 4.5.0-10.el7_6.12 Red Hat Enterprise Linux ComputeNode (v. 7) libvirt 4.5.0-10.el7_6.12, libvirt-libs 4.5.0-10.el7_6.12, libvirt-client 4.5.0-10.el7_6.12, libvirt-bash-completion 4.5.0-10.el7_6.12 Red Hat Enterprise Linux ComputeNode Optional (v. 7) libvirt 4.5.0-10.el7_6.12, libvirt-nss 4.5.0-10.el7_6.12, libvirt-admin 4.5.0-10.el7_6.12, libvirt-daemon 4.5.0-10.el7_6.12, libvirt-daemon-kvm 4.5.0-10.el7_6.12, libvirt-daemon-lxc 4.5.0-10.el7_6.12, +20 more
fixed: vendor fix RHSA-2019:1579
Red Hat Enterprise Linux Desktop (v. 6) libvirt 0.10.2-64.el6_10.2, libvirt-client 0.10.2-64.el6_10.2, libvirt-python 0.10.2-64.el6_10.2 Red Hat Enterprise Linux Desktop Optional (v. 6) libvirt-lock-sanlock 0.10.2-64.el6_10.2
fixed: vendor fix RHSA-2019:1578
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) libvirt 4.5.0-10.el7_6.12, libvirt-libs 4.5.0-10.el7_6.12, libvirt-client 4.5.0-10.el7_6.12, libvirt-daemon 4.5.0-10.el7_6.12, libvirt-daemon-kvm 4.5.0-10.el7_6.12, libvirt-bash-completion 4.5.0-10.el7_6.12, +16 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) libvirt 4.5.0-10.el7_6.12, libvirt-nss 4.5.0-10.el7_6.12, libvirt-libs 4.5.0-10.el7_6.12, libvirt-admin 4.5.0-10.el7_6.12, libvirt-client 4.5.0-10.el7_6.12, libvirt-daemon 4.5.0-10.el7_6.12, +21 more
fixed: vendor fix RHSA-2019:1579
Red Hat Enterprise Linux HPC Node (v. 6) libvirt 0.10.2-64.el6_10.2, libvirt-client 0.10.2-64.el6_10.2, libvirt-python 0.10.2-64.el6_10.2 Red Hat Enterprise Linux HPC Node Optional (v. 6) libvirt-lock-sanlock 0.10.2-64.el6_10.2 Red Hat Enterprise Linux Server (v. 6) libvirt 0.10.2-64.el6_10.2, libvirt-client 0.10.2-64.el6_10.2, libvirt-python 0.10.2-64.el6_10.2
fixed: vendor fix RHSA-2019:1578
Red Hat Enterprise Linux Server (v. 7) libvirt 4.5.0-10.el7_6.12, libvirt-libs 4.5.0-10.el7_6.12, libvirt-client 4.5.0-10.el7_6.12, libvirt-daemon 4.5.0-10.el7_6.12, libvirt-daemon-kvm 4.5.0-10.el7_6.12, libvirt-bash-completion 4.5.0-10.el7_6.12, +18 more
fixed: vendor fix RHSA-2019:1579
Red Hat Enterprise Linux Server Optional (v. 6) libvirt-lock-sanlock 0.10.2-64.el6_10.2
fixed: vendor fix RHSA-2019:1578

show 7 more

Red Hat Enterprise Linux Server Optional (v. 7) libvirt-nss 4.5.0-10.el7_6.12, libvirt-admin 4.5.0-10.el7_6.12, libvirt-daemon-lxc 4.5.0-10.el7_6.12, libvirt-login-shell 4.5.0-10.el7_6.12, libvirt-lock-sanlock 4.5.0-10.el7_6.12
fixed: vendor fix RHSA-2019:1579
Red Hat Enterprise Linux Workstation (v. 6) libvirt 0.10.2-64.el6_10.2, libvirt-client 0.10.2-64.el6_10.2, libvirt-python 0.10.2-64.el6_10.2
fixed: vendor fix RHSA-2019:1578
Red Hat Enterprise Linux Workstation (v. 7) libvirt 4.5.0-10.el7_6.12, libvirt-libs 4.5.0-10.el7_6.12, libvirt-client 4.5.0-10.el7_6.12, libvirt-daemon 4.5.0-10.el7_6.12, libvirt-daemon-kvm 4.5.0-10.el7_6.12, libvirt-bash-completion 4.5.0-10.el7_6.12, +18 more
fixed: vendor fix RHSA-2019:1579
Red Hat Enterprise Linux Workstation Optional (v. 6) libvirt-lock-sanlock 0.10.2-64.el6_10.2
fixed: vendor fix RHSA-2019:1578
Red Hat Enterprise Linux Workstation Optional (v. 7) libvirt-nss 4.5.0-10.el7_6.12, libvirt-admin 4.5.0-10.el7_6.12, libvirt-daemon-lxc 4.5.0-10.el7_6.12, libvirt-login-shell 4.5.0-10.el7_6.12, libvirt-lock-sanlock 4.5.0-10.el7_6.12
fixed: vendor fix RHSA-2019:1579
Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.4-20190620.3.el7_6, redhat-virtualization-host-image-update 4.3.4-20190620.3.el7_6 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.4-1.el7ev, redhat-virtualization-host-image-update-placeholder 4.3.4-1.el7ev
fixed: vendor fix RHSA-2019:1699
Red Hat Enterprise Linux 5 libvirt Red Hat Storage 3 libvirt-lock-sanlock
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

Libvirt libvirt

Classification

Weakness

CWE-284 Improper Access Control
CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-862 Missing Authorization

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10161
issue-tracking, patch, third-party-advisory
usn.ubuntu.com /4047-2/
vendor-advisory, third-party-advisory
security.gentoo.org /glsa/202003-18
vendor-advisory, third-party-advisory
access.redhat.com /libvirt-privesc-vulnerabilities
third-party-advisory
libvirt.org /git/?p=libvirt.git%3Ba=commit%3Bh=aed6a032cead4386472afb24b16196579e239580

Sources

CVE List CVE-2019-10161
NVD CVE-2019-10161

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary