Description
An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The libvirt Project | libvirt | 4.8.0 and above | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 5.0.0-2 | — |
| Debian 13 | libvirt | 5.0.0-2 | — |
| Debian 12 | libvirt | 5.0.0-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | SLOF | 20190703-1.gitba1ab360.module+el8.1.0+3730+7d905127 | RHBA-2019:3723 |
| RHEL 8 | hivex +6 | 1.3.15-7.module+el8.1.0+3554+1a3a94a6 | RHBA-2019:3723 |
| RHEL 8 | libguestfs-winsupport | 8.0-4.module+el8.1.0+3554+1a3a94a6 | RHBA-2019:3723 |
| RHEL 8 | libiscsi +2 | 1.18.0-8.module+el8.1.0+3554+1a3a94a6 | RHBA-2019:3723 |
| RHEL 8 | libtpms +1 | 0.6.1-0.20190121git9dc915572b.module+el8.1.0+3523+b348b848.2 | RHBA-2019:3723 |
| RHEL 8 | libvirt +28 | 5.6.0-6.module+el8.1.0+4244+9aa4e6bb | RHBA-2019:3723 |
| RHEL 8 | libvirt-dbus | 1.3.0-2.module+el8.1.0+3554+1a3a94a6 | RHBA-2019:3723 |
| RHEL 8 | libvirt-python +1 | 5.6.0-2.module+el8.1.0+4286+bc7b622c | RHBA-2019:3723 |
| RHEL 8 | nbdkit +13 | 1.12.5-1.module+el8.1.0+3868+35f94834 | RHBA-2019:3723 |
| RHEL 8 | netcf +2 | 0.2.8-12.module+el8.1.0+3921+a49f7d7b | RHBA-2019:3723 |
| RHEL 8 | perl-Sys-Virt | 5.6.0-2.module+el8.1.0+4140+e3893fe6 | RHBA-2019:3723 |
| RHEL 8 | qemu-img +10 | 15:4.1.0-13.module+el8.1.0+4313+ef76ec61 | RHBA-2019:3723 |
| RHEL 8 | seabios +2 | 1.12.0-5.module+el8.1.0+4022+29a53beb | RHBA-2019:3723 |
| RHEL 8 | sgabios +1 | 1:0.20170427git-3.module+el8.1.0+3554+1a3a94a6 | RHBA-2019:3723 |
| RHEL 8 | supermin +1 | 5.1.19-10.module+el8.1.0+4076+b5e41ebc | RHBA-2019:3723 |
| RHEL 8 | swtpm +3 | 0.1.0-1.20190425gitca85606.module+el8.1.0+3966+4a23dca1.1 | RHBA-2019:3723 |
| RHEL 8 | virglrenderer +2 | 0.6.0-5.20180814git491d3b705.module+el8.1.0+3523+b348b848 | RHBA-2019:3723 |
| RHEL 8 | virt-dib +26 | 1:1.40.2-14.module+el8.1.0+4230+0b6e3259 | RHBA-2019:3723 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | libvirt | 4.0.0-9.19.4 | SUSE-SU-2019:1285-1 |
| SLES 12 SP4 | libvirt | 4.0.0-8.9.1 | SUSE-SU-2019:0948-1 |
| SLES 12 SP3 | libvirt | 3.3.0-5.30.1 | SUSE-SU-2019:1042-1 |
| SLES 12 SP2 | libvirt | 2.0.0-27.54.1 | SUSE-SU-2019:1438-1 |
| SLES 11 SP4 | libvirt | 1.2.5-23.20.1 | SUSE-SU-2019:14097-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | libvirt | 4.0.0-8.9.1 | SUSE-SU-2019:0948-1 |
| SLES for SAP 12 SP3 | libvirt | 3.3.0-5.30.1 | SUSE-SU-2019:1042-1 |
| SLES for SAP 12 SP2 | libvirt | 2.0.0-27.54.1 | SUSE-SU-2019:1438-1 |
| SUSE OpenStack Cloud 7 | libvirt | 2.0.0-27.54.1 | SUSE-SU-2019:1438-1 |
| SUSE Enterprise Storage 4 | libvirt | 2.0.0-27.54.1 | SUSE-SU-2019:1438-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libvirt | 7.7.0-2.1 | openSUSE-SU-2024:11008-1 |
Advisories 7
- RHBA-2019:3723 Red Hat Bug Fix Advisory: Advanced Virtualization bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- SUSE-SU-2019:1285-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1438-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1042-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11008-1 libvirt-7.7.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14097-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0948-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 107777 vdb-entry
- openSUSE-SU-2019:1294 vendor-advisory
- USN-4021-1 vendor-advisory
- FEDORA-2019-b2dfb13daf vendor-advisory
- FEDORA-2019-9210998aaa vendor-advisory
- RHBA-2019:3723 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3886