World-writable libvirt control socket enables privilege escalation on Ubuntu

Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.

• Ubuntu libvirt on the Ubuntu 20.04 LTS branch is affected when the package version is less than 6.0.0-0ubuntu8.3.
• Ubuntu identifies the relevant packages as libvirt-daemon, libvirt-daemon-system, and libvirt0.
• Ubuntu provides the fix for the 20.04 LTS branch in version 6.0.0-0ubuntu8.3 of those packages.
• No additional Ubuntu release branch is confirmed in the supplied affected facts or the Ubuntu notice. Other branches must not be assumed unaffected.
• Red Hat describes the issue as Ubuntu-specific and states that libvirt packages in Red Hat Enterprise Linux and Red Hat Advanced Virtualization are not affected because they use polkit for authentication.

Ubuntu's libvirt packaging creates a UNIX domain control socket with read and write permissions for all users, an instance of CWE-732, Incorrect Permission Assignment for a Critical Resource. A local attacker can access libvirt through the socket and issue control or RPC requests. The record states that this can lead to arbitrary file overwrite or arbitrary code execution, with possible privilege escalation because the libvirt service can run programs as an administrator. The public record does not identify the specific RPC, code path, payload, or file-write primitive involved. Red Hat describes the issue as Ubuntu-specific and states that its libvirt packages use polkit to authenticate requests.

The vulnerability is locally reachable and is not described as directly exploitable over a network. The supplied assessments describe low attack complexity and no user interaction. The Canonical assessment models no privileges required, while the NVD assessment models low privileges; the Ubuntu notice confirms a local attacker but does not add an authentication prerequisite. The supplied record does not identify actual exploitation, a public exploit, or a ransomware campaign; that absence of information does not establish that none exists.

The flaw permits unauthorized local access to the libvirt control interface, which can then be used to overwrite arbitrary files or execute arbitrary code. Potential consequences include escalation to administrator privileges, modification of configuration or data accessible to the service, and loss of confidentiality, integrity, or availability. The documented reachability is local; the specific effect on guests or workloads managed by libvirt is not established. The differing privilege prerequisites in the supplied assessments should be considered when evaluating exposure, but they do not change the need to update affected packages.

A successful attack could let a local attacker modify arbitrary files on the host, execute code with elevated privileges, and alter the state of services or the operating system. Possible consequences include loss of configuration integrity, exposure of data accessible to the compromised process, or service disruption. The record does not specify the effect on particular virtual-machine workloads, so impact to every guest should not be assumed. Red Hat states that its libvirt packages are not affected because this is an Ubuntu-specific packaging issue.

1. Update libvirt-daemon, libvirt-daemon-system, and libvirt0 on Ubuntu 20.04 LTS to version 6.0.0-0ubuntu8.3.
2. Reboot after the update as instructed by Ubuntu so that all required changes take effect.
3. Verify the installed package versions and the permissions on the UNIX domain control socket after updating. Treat the system as remediated only when the relevant packages meet the fixed version.
4. The record does not provide a specific temporary workaround. Do not treat a self-directed socket-permission change or access restriction as a vendor-confirmed fix; if patching is delayed, use any such measure only as temporary risk reduction after assessing its effect on libvirt operation.

1. Inventory Ubuntu systems running libvirt-daemon, libvirt-daemon-system, or libvirt0, then compare installed package versions with the affected and fixed boundaries.
2. Inspect the UNIX domain control socket used by the installed libvirt service and verify that it is not readable or writable by all users. Do not assume a socket path without confirming it from the active configuration and service state.
3. Review local audit logs or telemetry for unusual access to the control socket, unexpected file changes, or program execution with administrator-level privileges. These are precautionary review points, not confirmed indicators of compromise.
4. After updating, verify the installed versions of all relevant libvirt packages and reboot as instructed by Ubuntu so that all required changes take effect.