CVE-2019-10183 Information disclosure in virt-install

Low 3.2 Published 3 Jul 2019 Updated 4 Aug 2024

The virt-install utility leaks guest VM passwords to other local users via process listings when the unattended option is used.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-10183?

CVE-2019-10183 is a low-severity vulnerability in Redhat Enterprise Linux, published on 3 Jul 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.

Weakness: CWE-200

Which versions are affected by CVE-2019-10183?

It affects 2 products.

Linux distribution packages (4)

`virt-install` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.2.1-2.el8`
`virt-manager` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.2.1-2.el8`
`virt-manager-common` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.2.1-2.el8`
`virt-manager` openSUSE:Tumbleweed	All versions	`3.2.0-10.1`

Products include Redhat Enterprise Linux, Redhat Virt-Manager.

How do I fix CVE-2019-10183?

Apply the vendor's patch.

Is CVE-2019-10183 being exploited?

There is no known exploitation of CVE-2019-10183 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as GHSA-mjgr-85qm-mjv5, RHSA-2019:3464, UBUNTU-CVE-2019-10183, openSUSE-SU-2024:11500-1.