CVE-2013-4291: The virSecurityManagerSetProcessLabel function in libvirt 0.10.2.7, 1.0.5.5, and 1.1.1, when the domain has...

Security readout for executives and security teams

This is an old libvirt local privilege-escalation issue. On affected libvirt versions, process security labels using uid:gid handling may set group membership incorrectly, giving a local user a path to higher privileges. The bundle does not provide CVSS, confirmed affected product packaging, or active-exploitation evidence. Exposure is most likely on legacy Linux virtualization hosts still running the named libvirt versions or downstream packages derived from them. Risk requires local user access or an equivalent foothold on the host. The provided affected-product metadata is incomplete and lists no specific vendor packages. Medium priority unless affected hosts are multi-user, internet-facing through management services, or shared across tenants. The main business concern is privilege escalation after local access, so remediation should align with virtualization host patch cycles and access-control reviews. Mitigation focus: Inventory libvirt versions on virtualization hosts and prioritize any named affected versions.; Upgrade affected libvirt packages to vendor-supported patched releases.; Review Red Hat and libvirt guidance for exact downstream fixed package versions..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.