Description
virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libguestfs | 1:1.18.0-1 | — |
| Debian 13 | libguestfs | 1:1.18.0-1 | — |
| Debian 12 | libguestfs | 1:1.18.0-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libguestfs +11 | 1:1.16.19-1.el6 | RHSA-2012:0774 |
Advisories 1
- RHSA-2012:0774 Red Hat Security Advisory: libguestfs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 49545 third-party-advisory
- [Libguestfs] 20120521 [ANNOUNCE] libguestfs 1.18 released - tools for managing virtual machines and disk images mailing-list
- 53932 vdb-entry
- libguestfs-virtedit-info-disc(76220) vdb-entry
- RHSA-2012:0774 vendor-advisory
- 49431 third-party-advisory