Vulnerability · Published Nov 6, 2020 · Assigned by canonical
CVE-2020-15708Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability
Critical 9.3
In plain English
A critical-severity incorrect permission assignment in libvirt from Ubuntu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.4%top 65.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.
Affected products (as reported)
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://usn.ubuntu.com/usn/usn-4452-1 x_refsource_MISC