Description
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 2.2.0-1 | — |
| Debian 13 | libvirt | 2.2.0-1 | — |
| Debian 12 | libvirt | 2.2.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libvirt | No fix yet | — |
| Ubuntu Pro 14.04 LTS | libvirt | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | libvirt +19 | 2.0.0-10.el7 | RHSA-2016:2577 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | libvirt-daemon-lxc +2 | 2.0.0-10.el7 | RHSA-2016:2577 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libvirt +19 | 2.0.0-10.el7 | ELSA-2016-2577 |
Advisories 2
- RHSA-2016:2577 Red Hat Security Advisory: libvirt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- ELSA-2016-2577 Moderate: libvirt security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 9, 2016