CVE-2019-12928
Description
QEMU's Machine Protocol (QMP) is designed to enable remote applications (ex. Libvirt) to control and manage QEMU process instances. It is meant to be used by trusted users and applications. The TCP server socket is only one of the transport options supported by QMP; other, more secure options, being local UNIX socket. If one is able to run 'migrate' command, the user already has access to the guest VM. Then migrating guest state to an unworthy remote machine via nc is not really a security issue.
Libvirt only uses local UNIX sockets to interact with the guest VMs that it manages. This UNIX socket is owned by the same user-id as the QEMU process instance. Other users on the system cannot connect to the UNIX socket. Libvirt also creates a unique per-VM sVirt label so VMs cannot access each other's UNIX sockets, even though they are owned by the same system user-id.
Statement
The QEMU Machine Protocol (QMP) is for administrative control of QEMU instances. Access to QMP allows an attacker to manipulate all aspects of guest virtual machines by design, and as a consequence it must not be exposed to unprivileged users. Because an attacker could use access to QMP to compromise a system regardless of the presence of this vulnerability, and because correct access controls applied to the network connections used by QMP would prevent exploitation of this vulnerability, Red Hat assesses its impact as Low.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 0 | 9.8 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | High | N/A |
| Integrity Impact | None | High | N/A |
| Availability Impact | None | High | N/A |
Vector
Red Hat: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
NVD: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
not a bug.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
