Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

OpenEuler libvirt may expose VM data during volume copy

published 1 month ago

Summary

The libvirt component on OpenEuler can temporarily make new virtual machine disk files readable by any user on the host when a volume is cloned or converted. This could allow other local users to see sensitive information stored inside the guest machines. Apply the latest libvirt update as soon as possible to fix the file permission handling.

What to do

Update openeuler libvirt to version 9.10.0-45.oe2403sp3.

Affected software

Ecosystem	Vendor	Product	Affected versions
openEuler:24.03-LTS-SP3	openeuler	libvirt	< 9.10.0-45.oe2403sp3 Fix: upgrade to 9.10.0-45.oe2403sp3

Original advisory text

libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.(CVE-2026-63623)

References

https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-63623 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Timeline

Published20 Sep 2026

Updated20 Sep 2026

First seen20 Sep 2026

Sources

OESA-2026-3882 · OSV

Track software like this

Free during beta