CVE-2017-15114 Missing authorization in n/a

High 8.1 Published 27 Nov 2017 Updated 5 Aug 2024

Misconfigured TLS in libvirtd allows other services to connect without additional authentication, enabling privilege escalation to root on compute nodes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-15114?

CVE-2017-15114 is a high-severity missing authorization vulnerability in n/a, published on 27 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd services. As no additional authentication is configured this allows these services to connect to libvirtd (which is equivalent to root access). If a vulnerability exists in another service it could, combined with this flaw, be exploited to escalate privileges to gain control over compute nodes.

Weakness: CWE-295

Which versions are affected by CVE-2017-15114?

It affects 1 product.

Products include Redhat Openstack Platform.

How do I fix CVE-2017-15114?

No fix has been published for CVE-2017-15114 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2017-15114 being exploited?

There is no known exploitation of CVE-2017-15114 in the wild and no public exploit code.

Sources

Also known as GHSA-5h4f-9xqg-f36m, UBUNTU-CVE-2017-15114.