CVE-2015-5201 Auth bypass in Enterprise Virtualization Hypervisor (aka RHEV-H)

High 7.5 Published 25 Feb 2020 Updated 6 Aug 2024

Remote attackers can bypass authentication and log in to suspended virtual machines when SPICE ticketing is disabled in Red Hat Enterprise Virtualization.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2015-5201?

CVE-2015-5201 is a high-severity authentication bypass vulnerability in RedHat Enterprise Virtualization Hypervisor (aka RHEV-H), published on 25 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows remote attackers to log in without authentication via unspecified vectors.

Weakness: CWE-306

Which versions are affected by CVE-2015-5201?

It affects 2 products.

Linux distribution packages (3)

`rhev-hypervisor6` Red Hat:enterprise_linux:6::hypervisor	All versions	`0:6.7-20151123.0.el6ev`
`rhev-hypervisor7` Red Hat:enterprise_linux:6::hypervisor	All versions	`0:7.2-20151129.1.el6ev`
`rhev-hypervisor7` Red Hat:enterprise_linux:7::hypervisor	All versions	`0:7.2-20151129.1.el7ev`

Products include Redhat Enterprise Virtualization, Redhat Enterprise Virtualization Hypervisor.

How do I fix CVE-2015-5201?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2015-5201 being exploited?

There is no known exploitation of CVE-2015-5201 in the wild and no public exploit code.

Sources

Also known as GHSA-2896-6gvq-8vjr, RHEA-2015:2527.