Description
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libguestfs | 1:1.22.7-1 | — |
| Debian 13 | libguestfs | 1:1.22.7-1 | — |
| Debian 12 | libguestfs | 1:1.22.7-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libguestfs | No fix yet | — |
| Ubuntu 26.04 LTS | libguestfs | No fix yet | — |
| Ubuntu 25.10 | libguestfs | No fix yet | — |
| Ubuntu 24.04 LTS | libguestfs | No fix yet | — |
| Ubuntu 22.04 LTS | libguestfs | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libguestfs | No fix yet | — |
| Ubuntu 18.04 LTS | libguestfs | No fix yet | — |
| Ubuntu 16.04 LTS | libguestfs | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libguestfs +11 | 1:1.20.11-2.el6 | RHSA-2013:1536 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libguestfs | 1.32.4-11.1 | openSUSE-SU-2024:10032-1 |
Advisories 2
- RHSA-2013:1536 Red Hat Security Advisory: libguestfs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10032-1 guestfs-data-1.32.4-11.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2013:1536 vendor-advisory
- 55813 third-party-advisory
- [Libguestfs] 20131017 ANNOUNCE: CVE-2013-4419: insecure temporary directory handling for guestfish's network socket mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1016960
- SUSE-SU-2013:1626 vendor-advisory