Description
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libvirt | libvirt | 4.x.x before 4.10.1, 5.x.x before 5.4.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 5.0.0-4 | — |
| Debian 13 | libvirt | 5.0.0-4 | — |
| Debian 12 | libvirt | 5.0.0-4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | SLOF | 20171214-5.gitfa98132.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | hivex +4 | 1.3.15-6.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | libguestfs-winsupport | 8.0-2.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | libiscsi +2 | 1.18.0-6.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | libssh2 | 1.8.0-7.module+el8.0.0.z+3418+a72cf898.1 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | libvirt +27 | 4.5.0-23.3.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | libvirt-daemon-driver-storage-iscsi-direct | 5.0.0-7.2.module+el8.0.0.z+3438+2851622e | RHSA-2019:1762 |
| RHEL 8 | libvirt-dbus | 1.2.0-2.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | libvirt-python +1 | 4.5.0-1.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | nbdkit +9 | 1.4.2-4.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | netcf +2 | 0.2.8-10.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | perl-Sys-Virt | 4.5.0-4.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | qemu-img +9 | 15:2.12.0-64.module+el8.0.0.z+3418+a72cf898.2 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | seabios +2 | 1.11.1-3.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | sgabios +1 | 1:0.20170427git-2.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | supermin +1 | 5.1.19-8.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 8 | virt-dib +24 | 1:1.38.4-10.1.module+el8.0.0.z+3418+a72cf898 | RHSA-2019:1762, RHSA-2019:1580 |
| RHEL 7 | libvirt +30 | 4.5.0-10.el7_6.12 | RHSA-2019:1579 |
| RHEL 7 | redhat-release-virtualization-host +1 | 4.3.4-1.el7ev | RHSA-2019:1699 |
| RHEL 7 | redhat-virtualization-host +1 | 4.3.4-20190620.3.el7_6 | RHSA-2019:1699 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | libvirt | 5.1.0-8.6.1 | SUSE-SU-2019:1643-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libvirt | 7.7.0-2.1 | openSUSE-SU-2024:11008-1 |
| openSUSE Leap 15.1 | libvirt | 5.1.0-lp151.7.3.1 | openSUSE-SU-2019:1753-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libvirt | 5.5.0-r0 | — |
| Alpine v3.23 | libvirt | 5.5.0-r0 | — |
| Alpine v3.22 | libvirt | 5.5.0-r0 | — |
| Alpine v3.21 | libvirt | 5.5.0-r0 | — |
| Alpine v3.20 | libvirt | 5.5.0-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libvirt | 5.5.0-r0 | — |
| Alpine v3.18 | libvirt | 5.5.0-r0 | — |
| Alpine v3.17 | libvirt | 5.5.0-r0 | — |
| Alpine v3.16 | libvirt | 5.5.0-r0 | — |
| Alpine v3.15 | libvirt | 5.5.0-r0 | — |
| Alpine v3.14 | libvirt | 5.5.0-r0 | — |
| Alpine v3.13 | libvirt | 5.5.0-r0 | — |
| Alpine v3.12 | libvirt | 5.5.0-r0 | — |
| Alpine v3.11 | libvirt | 5.5.0-r0 | — |
| Alpine v3.10 | libvirt | 5.5.0-r0 | — |
| Alpine v3.9 | libvirt | 5.5.0-r0 | — |
| Alpine v3.8 | libvirt | 5.5.0-r0 | — |
| Alpine v3.7 | libvirt | 5.5.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | libvirt +30 | 4.5.0-10.amzn2.12.1 | ALAS2-2019-1274 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | hivex +4 | 1.3.15-6.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | libguestfs-winsupport | 8.0-2.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | libiscsi +2 | 1.18.0-6.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | libssh2 | 1.8.0-7.module+el8.0.0.z+5234+5e9073e3.1 | ELSA-2019-1580 |
| Oracle Linux 8 | libvirt +27 | 4.5.0-23.3.0.1.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | libvirt-dbus | 1.2.0-2.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | nbdkit +9 | 1.4.2-4.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | netcf +2 | 0.2.8-10.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | perl-Sys-Virt | 4.5.0-4.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | python3-libvirt | 4.5.0-1.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | qemu-img +9 | 15:2.12.0-64.module+el8.0.0.z+5234+5e9073e3.2 | ELSA-2019-1580 |
| Oracle Linux 8 | seabios +2 | 1.11.1-3.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | sgabios +1 | 1:0.20170427git-2.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | supermin +1 | 5.1.19-8.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 8 | virt-dib +24 | 1:1.38.4-10.1.0.1.module+el8.0.0.z+5234+5e9073e3 | ELSA-2019-1580 |
| Oracle Linux 7 | libvirt +30 | 4.5.0-10.0.1.el7_6.12 | ELSA-2019-4714, ELSA-2019-1579 |
| Oracle Linux 7 | libvirt-daemon-qemu | 5.0.0-9.el7 | ELSA-2019-4714 |
Advisories 12
- RHSA-2019:1762 Red Hat Security Advisory: virt:8.0.0 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:1699 Red Hat Security Advisory: redhat-virtualization-host security and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:1580 Red Hat Security Advisory: virt:rhel security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:1579 Red Hat Security Advisory: libvirt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- SUSE-SU-2019:1643-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1753-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11008-1 libvirt-7.7.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1690 libvirt: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Jul 9, 2023
- ALAS2-2019-1274 Important: libvirt security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 27, 2019
- ELSA-2019-1580 Important: virt:ol security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 30, 2019
- ELSA-2019-4714 Important: libvirt security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 10, 2019
- ELSA-2019-1579 Important: libvirt security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 21, 2019