CVE-2019-10161: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

Affected products

• Canonical Ubuntu Linux: version 14.04 only
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only; version 8.0 only
• Red Hat Libvirt: before 4.10.1 (fixed in 4.10.1); from 5.0.0, before 5.4.1 (fixed in 5.4.1)
• Red Hat Virtualization: version 4.0 only
• Red Hat Virtualization Host: version 4.0 only

Published 2019-07-30. Last modified 2026-06-17.