CVE-2015-5313

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-5313
Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.

2.5 /10

CVSS v3 : LOW

V3 Legend

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=034e47c338b13a95cf02106a3af912c1c5f818d7
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174404.html
http://rhn.redhat.com/errata/RHSA-2016-2577.html
http://security.libvirt.org/2015/0004.html Patch Vendor Advisory
http://www.securityfocus.com/bid/90913
https://security.gentoo.org/glsa/201612-10
https://www.redhat.com/archives/libvir-list/2015-December/msg00473.html
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:libvirt:-:*:*:*:*:*:*:*
History

13 Feb 2023, 00:53

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:2577', 'name': 'https://access.redhat.com/errata/RHSA-2016:2577', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-5313', 'name': 'https://access.redhat.com/security/cve/CVE-2015-5313', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1277121', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1277121', 'tags': [], 'refsource': 'MISC'}
Summary A path-traversal flaw was found in the way the libvirt daemon handled filesystem names for storage volumes. A libvirt user with privileges to create storage volumes and without privileges to create and modify domains could possibly use this flaw to escalate their privileges. Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.

02 Feb 2023, 21:15

Type Values Removed Values Added
Summary Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name. A path-traversal flaw was found in the way the libvirt daemon handled filesystem names for storage volumes. A libvirt user with privileges to create storage volumes and without privileges to create and modify domains could possibly use this flaw to escalate their privileges.
References
  • {'url': 'http://libvirt.org/git/?p=libvirt.git;a=commit;h=034e47c338b13a95cf02106a3af912c1c5f818d7', 'name': 'http://libvirt.org/git/?p=libvirt.git;a=commit;h=034e47c338b13a95cf02106a3af912c1c5f818d7', 'tags': [], 'refsource': 'CONFIRM'}
  • (MISC) https://access.redhat.com/errata/RHSA-2016:2577 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1277121 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-5313 -
  • (MISC) http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=034e47c338b13a95cf02106a3af912c1c5f818d7 -
Information

Published : 2016-04-11 21:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-5313

Mitre link : CVE-2015-5313

CVE.ORG link : CVE-2015-5313

JSON object : View

Products Affected

redhat

  • libvirt
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')