CVE-2026-63623: 
Linux Red Hat 脆弱性の分析と軽減

CVE-2026-63623 is an information disclosure vulnerability in libvirt caused by incorrect file permission assignment (CWE-732) during storage volume clone or convert operations. Newly created volume images are temporarily world-readable because the qemu-img utility runs with overly permissive file creation settings (umask 0), allowing any local user to read the full contents of guest disk images. The vulnerability affects libvirt as shipped by Red Hat across multiple product lines; specific fixed version numbers have not yet been publicly enumerated. It was published on August 10, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is in src/storage/storage_util.c within libvirt's virStorageBackendCreateExecCommand() function, which invoked qemu-img with umask 0 on non-NETFS local storage paths, causing newly created volume images to be created with world-readable permissions (mode 0644). libvirt only applied restrictive permissions via chmod() after qemu-img completed, creating a race window during which any local user could read the full guest disk contents. The upstream fix moves the virCommandSetUmask() call to apply unconditionally to all code paths, ensuring qemu-img creates files with restrictive permissions from the outset. This is noted as the same class of issue as CVE-2025-13193. The upstream patch is available at the libvirt GitLab repository (Red Hat Bugzilla).

Successful exploitation allows any low-privileged local user to read the complete contents of guest virtual machine disk images during storage volume clone or convert operations, resulting in high confidentiality impact. Sensitive data stored on guest disks — including credentials, configuration files, application data, and encryption keys — may be exposed. There is no integrity or availability impact; the vulnerability is limited to information disclosure within the scope of the affected host system (Red Hat Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and depends on timing a read operation during the race window when a storage volume clone or convert operation is in progress (Red Hat Bugzilla).

1. Gain local access: Obtain a low-privileged local user account on a host system running a vulnerable version of libvirt.
2. Monitor for clone/convert operations: Watch for storage volume clone or convert operations being initiated by libvirt (e.g., by monitoring process activity with inotifywait or auditd on the libvirt storage pool directory).
3. Identify the target file: When qemu-img is invoked, identify the path of the newly created volume image in the storage pool directory (e.g., /var/lib/libvirt/images/).
4. Read the world-readable file: During the race window before libvirt applies chmod() to restrict permissions, open and read the volume image file (e.g., using dd, cat, or cp) to obtain the full guest disk contents.
5. Extract sensitive data: Analyze the copied disk image offline to extract credentials, configuration files, or other sensitive data stored within the guest virtual machine (Red Hat Bugzilla).

• File System: Unexpected access to files in the libvirt storage pool directory (e.g., /var/lib/libvirt/images/) by non-root, non-libvirt users; newly created volume images with world-readable permissions (mode 0644) present on disk.
• Logs: Audit log entries (/var/log/audit/audit.log) showing open or read syscalls on volume image files by unprivileged user accounts during or shortly after a qemu-img process execution.
• Process: qemu-img processes spawned by libvirt during storage volume clone or convert operations; concurrent file read activity by non-privileged users on the same volume image path.

A patch has been committed upstream to the libvirt GitLab repository (commit 69335a484768d550854da1133d5490074695e825) that moves the virCommandSetUmask() call to apply unconditionally, preventing world-readable file creation by qemu-img. Red Hat has acknowledged the vulnerability and states that no currently available mitigation meets their deployment criteria, so upgrading to a patched libvirt package is the recommended remediation (Red Hat Advisory). As an interim measure, administrators should restrict access to libvirt storage pool directories (e.g., /var/lib/libvirt/images/) to authorized users only, and monitor for unauthorized file access using auditd rules on those paths (Red Hat Bugzilla).

Red Hat credited HE WEI (gikaku) for responsibly reporting this issue and has published a security advisory acknowledging the vulnerability (Red Hat Advisory). No significant broader community discussion, researcher commentary, or media coverage has been observed as of the disclosure date.