Compliance Impact

This vulnerability allows an attacker with certain privileges to execute arbitrary commands as the Glances user, typically root, on hypervisor hosts. Such unauthorized command execution can lead to full system compromise, including data exfiltration, file tampering, and service disruption.

These impacts can result in violations of common standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and system integrity. Specifically, unauthorized data access or modification could breach data privacy and security requirements mandated by these regulations.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Glances monitoring tool prior to version 4.5.5, specifically in its KVM/QEMU monitoring engine. The issue arises because the tool reads virtual machine domain names directly from the output of the 'virsh list --all' command and inserts them into f-string command templates without sanitization. These templates are then processed by a function called secure_popen(), which interprets certain shell operators like &&, |, and >. Because domain names are not sanitized, an attacker who can create or rename a virtual machines can inject arbitrary commands that will be executed with the privileges of the user running Glances, often root.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with the ability to create or rename KVM/QEMU virtual machines to execute arbitrary commands on the host operating system with the privileges of the Glances process, which is commonly running as root on hypervisor hosts. This can lead to full system compromise, including unauthorized access, data manipulation, or disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Glances to version 4.5.5 or later, where the issue has been fixed.

Additionally, restrict the ability to create or rename KVM/QEMU virtual machines to trusted users only, as the vulnerability allows arbitrary command execution by users who can manipulate VM domain names.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Glances monitoring tool is running a vulnerable version (prior to 4.5.5) and if the vms plugin is enabled. Additionally, verifying if the system uses the KVM/QEMU VM monitoring engine and if the virsh command is installed is important.

To detect potential exploitation or presence of malicious VM domain names, you can inspect the output of the command `virsh list --all` for suspicious domain names containing shell operators such as &&, |, or >.

Example commands to help detect this vulnerability or its exploitation include:

• Check Glances version: `glances --version` or check installed package version.
• List all virtual machines and inspect domain names: `virsh list --all`
• Search for suspicious characters in domain names: `virsh list --all | grep -E '[&|>]'`
• Check if the vms plugin is enabled in Glances configuration.

If suspicious domain names are found containing shell operators, this indicates potential exploitation or vulnerability presence.

Useful 0 Not Useful 0