When installing new host, RHEV-M connects to the host via ssh as root and copies vds_installer.py script into /tmp. vds_installer downloads deployUtil.py and vds_bootstrap.py via curl.

If we look into python docs [1], it clearly outlines the module search path. The first bullet says that:

"the directory containing the input script (or the current directory)."

is searched when the module to be imported is not built-in. In our case both the directory containing the input script and current directory is /tmp.

  [1] http://docs.python.org/tutorial/modules.html#the-module-search-path

To exploit the flaw you just need to create any of the imported modules in /tmp and it gets run as root upon host installation.

Other exploit might be to pre-create /tmp/deployUtil.py, wait for vor vds_installer to download it from RHEV-M and then change the content before it's imported/executed.

Either way, copying and running python scripts from /tmp is really bad idea. Use private directory in /tmp for scripts and logs.

vds_installer also creates log files with semi-random names which are prone to symlink attacks.

A local, unprivileged user on the host to be installed/addedd to RHEV-M could use this flaw to escalate their privileges.