CVE-2017-1000199

High

Published: 17/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

tcmu-runner versions 0.91 to 1.20 are vulnerable to information disclosure in handler_qcow.so, allowing non-privileged users to check for the existence of any file with root privileges.

Risk Assessment

Allowing non-privileged users to check for the existence of root-privileged files may lead to the disclosure of sensitive information and potential attacks on the system.

Recommendation

It is recommended to update tcmu-runner to the latest version to mitigate the risk associated with this vulnerability.

Other vulnerabilities in tcmu-runner

CVE-2017-1000200High
tcmu-runner versions 1.0.5 to 1.2.0 are vulnerable to a dbus triggered NULL pointer dereference in the tcmu-runner daemon's on_unregister_handler() function resulting in denial of service.

Original NVD description (English source)

tcmu-runner version 0.91 up to 1.20 is vulnerable to information disclosure in handler_qcow.so resulting in non-privileged users being able to check for existence of any file with root privileges.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS