CVE-2020-15708

A flaw was found in libvirt, where an incorrect permissions issue occurs on the UNIX domain socket. This flaw allows a local attacker to access libvirt and escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

This is an Ubuntu specific flaw. The versions of libvirt as shipped with Red Hat Enterprise Linux and RHEL Advanced Virtualization are not affected by this issue, as they leverage polkit for authentication. More specifically, the socket permission is 0666, and when an unprivileged user connects, polkit will validate the client and require them to provide the root password before libvirt allows any RPC calls to be performed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.