Daniel P. Berrangé

2 exploits Active since Jul 2019
CVE-2021-3631 WRITEUP MEDIUM WRITEUP
libvirt < 7.5.0 - Incorrect Permission Assignment for Critical Resource via SELinux MCS Category Pair Generation
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS 6.3
CVE-2019-13164 WRITEUP HIGH WRITEUP
QEMU 3.1 and 4.0.0 - ACL Bypass via Oversized Network Interface Name
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
CVSS 7.8