What’s Vulnerable › Vulnerabilities

CVE-2015-5160

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-08-20 · updated 2026-06-17
• Weakness: CWE-200

Description

libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.

Affected products

• Libvirt: before 2.2 — fixed in 2.2
• Red Hat Enterprise Linux: 5, 6.0
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Eus: 7.3, 7.4, 7.5, 7.6
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6
• RedHat Enterprise Linux Server Eus: 7.3, 7.4, 7.5, 7.6
• RedHat Enterprise Linux Server Tus: 7.3, 7.6
• RedHat Enterprise Linux Workstation: 7.0
• RedHat Virtualization: 3.0

How to fix

Upgrade to a fixed version: Libvirt 2.2. Check the vendor advisory for mitigations.

References

• http://rhn.redhat.com/errata/RHSA-2016-2577.html
• http://www.openwall.com/lists/oss-security/2017/07/21/3
• https://bugs.launchpad.net/ossn/+bug/1686743
• https://bugzilla.redhat.com/show_bug.cgi?id=1245647
• https://wiki.openstack.org/wiki/OSSN/OSSN-0079
• http://rhn.redhat.com/errata/RHSA-2016-2577.html
• http://www.openwall.com/lists/oss-security/2017/07/21/3
• https://bugs.launchpad.net/ossn/+bug/1686743
• https://bugzilla.redhat.com/show_bug.cgi?id=1245647
• https://wiki.openstack.org/wiki/OSSN/OSSN-0079

Get alerted when CVE-2015-5160 or the next vulnerability affects your stack