| Reported on: | 20190430 |
|---|---|
| Published on: | 20190421 |
| Fixed on: | 20190421 |
| Reported by: | Daniel P. Berrangé |
|---|---|
| Patched by: | Daniel P. Berrangé |
The virtlockd-admin.socket and virtlogd-admin.socket unit files do not set the SocketMode parameter and thus create a world accessible UNIX domain socket. Furthermore the code fails to validate the identity of clients connecting to these sockets.
An unprivileged user is able to connect to the virtlockd or virtlogd daemons and use the administrative RPC commands to elevate their privileges
Disable the virtlockd-admin.socket and virtlogd-admin.socket units in systemd. Alternative customize them to add SocketMode=0600 locally.