CVE-2019-12928

QEMU's Machine Protocol (QMP) is designed to enable remote applications (ex. Libvirt) to control and manage QEMU process instances. It is meant to be used by trusted users and applications. The TCP server socket is only one of the transport options supported by QMP; other, more secure options, being local UNIX socket. If one is able to run 'migrate' command, the user already has access to the guest VM. Then migrating guest state to an unworthy remote machine via nc is not really a security issue.

Libvirt only uses local UNIX sockets to interact with the guest VMs that it manages. This UNIX socket is owned by the same user-id as the QEMU process instance. Other users on the system cannot connect to the UNIX socket. Libvirt also creates a unique per-VM sVirt label so VMs cannot access each other's UNIX sockets, even though they are owned by the same system user-id.

The QEMU Machine Protocol (QMP) is for administrative control of QEMU instances. Access to QMP allows an attacker to manipulate all aspects of guest virtual machines by design, and as a consequence it must not be exposed to unprivileged users. Because an attacker could use access to QMP to compromise a system regardless of the presence of this vulnerability, and because correct access controls applied to the network connections used by QMP would prevent exploitation of this vulnerability, Red Hat assesses its impact as Low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.