IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.3Hoch

CVE-2026-12080Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4.22; Red Hat Red Hat OpenShift Container Platform 5.0; Red Hat Red Hat Enterp… Veröffentlicht: (vor 3 Monaten)

Beschreibung

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Schwachstellentyp (CWE): CWE-61

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
enterprise linux 9 —
openshift 4.22 —
openshift 5.0 —
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux for NVIDIA 26 —
Red Hat Red Hat OpenShift Container Platform 4 all versions
Red Hat Red Hat OpenShift Container Platform 4.22 all versions
Red Hat Red Hat OpenShift Container Platform 5.0 all versions

Referenzen und Patches

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

5.9Mittel
CVE-2026-122056

Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corru…

7.5Hoch
CVE-2026-112314

Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatche…

7.5Hoch
CVE-2026-112321

Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT re…

7.5Hoch
CVE-2026-112320

Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote atta…

6.5Mittel
CVE-2026-112319

Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that tri…

6.5Mittel
CVE-2026-112318

Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointe…