Skip to content
OpenAdvisories
Critical USN-4452-1 1 CVE

libvirt vulnerability

Published Aug 4, 2020 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Trent Shea working with Trend Micro´s Zero Day Initiative, discovered that
the libvirt package set incorrect permissions on the UNIX domain socket. A
local attacker could use this issue to access libvirt and escalate
privileges.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS libvirt 6.0.0-0ubuntu8.3

Vulnerabilities 1

  • Critical 9.3
    CVE-2020-15708

    Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability

    Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.

    Ubuntu libvirt libvirt Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2020-15708