Local Privilege Escalation in BMC Patrol from BMC Software

CVE-2016-9638

What is CVE-2016-9638?

A local privilege escalation vulnerability exists in BMC Patrol prior to version 9.13.10.02 due to incorrect configuration of the 'listguests64' binary. This binary is set with the setuid bit, allowing it to run with elevated privileges. When executed, it relies on the PATH environment variable to locate and execute another binary named 'virsh'. If a malicious local user can manipulate this environment, they may gain root-level access by executing arbitrary commands through 'virsh', thus compromising the system's security.

References