CVE-2015-5160

5.5 mediumEPSS 0.4%

Medium (5.5). EPSS 0.4% chance of exploitation in the next 30 days.

libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.

Severity

CVSS 3.0

5.5 medium

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2018-08-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

libvirt:libvirt
redhat:enterprise_linux
redhat:enterprise_linux_desktop
redhat:enterprise_linux_eus
redhat:enterprise_linux_server
redhat:enterprise_linux_server_aus
redhat:enterprise_linux_server_eus
redhat:enterprise_linux_server_tus
redhat:enterprise_linux_workstation
redhat:virtualization

References

http://rhn.redhat.com/errata/RHSA-2016-2577.html
http://www.openwall.com/lists/oss-security/2017/07/21/3
https://bugs.launchpad.net/ossn/+bug/1686743
https://bugzilla.redhat.com/show_bug.cgi?id=1245647
https://wiki.openstack.org/wiki/OSSN/OSSN-0079

Check your stack JSON