Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.

libvirt did not properly handle configured disk formats which potenially allowed users to read arbitrary files (CVE-2010-2237, CVE-2010-2238, CVE-2010-2239)

Improperly mapped source privileged ports in guests may allow obtaining privileged resources on the host (CVE-2010-2242).

libvirt did not properly handle configured disk formats which potentially allowed users to read arbitrary files. (CVE-2010-2237 / CVE-2010-2238 / CVE-2010-2239)

Improperly mapped source privileged ports in guests may allow obtaining privileged resources on the host. (CVE-2010-2242)

In addition, fixes for the following non-security issues were included :

  - libvirt based kvm guest save operation takes too long.
    (bnc#614853)

  - With greater than 37 CPUs virt-manager throws     exceptions. (bnc#609738)

  - Stopping more than one VirtualDomain will fail.
    (bnc#594024)

  - Unable to install SLES 9 SP4 guest from CDs on KVM     system. (bnc#626070)

USN-1008-1 fixed vulnerabilities in libvirt. The upstream fixes for CVE-2010-2238 changed the behavior of libvirt such that the domain XML could not specify 'host_device' as the qemu sub-type. While libvirt 0.8.3 and later will longer support specifying this sub-type, this update restores the old behavior on Ubuntu 10.04 LTS.

We apologize for the inconvenience.

It was discovered that libvirt would probe disk backing stores without consulting the defined format for the disk. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 10.04 LTS. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2010-2237, CVE-2010-2238)

It was discovered that libvirt would create new VMs without setting a backing store format. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue did not affect Ubuntu 8.04 LTS. In Ubuntu 9.10 and later guests are confined by an AppArmor profile which provided partial protection against this flaw.
(CVE-2010-2239)

Jeremy Nickurak discovered that libvirt created iptables rules with too lenient mappings of source ports. A privileged attacker in the guest could bypass intended restrictions to access privileged resources on the host.
(CVE-2010-2242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1008-1 fixed vulnerabilities in libvirt. The update for Ubuntu 10.04 LTS reverted a recent bug fix update. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that libvirt would probe disk backing stores without consulting the defined format for the disk. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 10.04 LTS. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2010-2237, CVE-2010-2238)

It was discovered that libvirt would create new VMs without setting a backing store format. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue did not affect Ubuntu 8.04 LTS. In Ubuntu 9.10 and later guests are confined by an AppArmor profile which provided partial protection against this flaw.
(CVE-2010-2239)

Jeremy Nickurak discovered that libvirt created iptables rules with too lenient mappings of source ports. A privileged attacker in the guest could bypass intended restrictions to access privileged resources on the host.
(CVE-2010-2242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Libvirt in Ubuntu 10.04 LTS now no longer probes qemu disks for the image format and defaults to 'raw' when the format is not specified in the XML. This change in behavior breaks virt-install --import because virtinst in Ubuntu 10.04 LTS did not allow for specifying a disk format and does not specify a format in the XML. This update adds the 'format=' option when specifying a disk. For example, to import an existing VM which uses a qcow2 disk format, use somthing like the following :

virt-install --connect=qemu:///session --name test-import --ram=256 \
--disk path=<path to qcow2 image>,format=qcow2 --import

For more information, see man 1 virt-install.

It was discovered that libvirt would probe disk backing stores without consulting the defined format for the disk. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 10.04 LTS. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2010-2237, CVE-2010-2238)

It was discovered that libvirt would create new VMs without setting a backing store format. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue did not affect Ubuntu 8.04 LTS. In Ubuntu 9.10 and later guests are confined by an AppArmor profile which provided partial protection against this flaw.
(CVE-2010-2239)

Jeremy Nickurak discovered that libvirt created iptables rules with too lenient mappings of source ports. A privileged attacker in the guest could bypass intended restrictions to access privileged resources on the host.
(CVE-2010-2242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libvirt would probe disk backing stores without consulting the defined format for the disk. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 10.04 LTS. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2010-2237, CVE-2010-2238)

It was discovered that libvirt would create new VMs without setting a backing store format. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue did not affect Ubuntu 8.04 LTS. In Ubuntu 9.10 and later guests are confined by an AppArmor profile which provided partial protection against this flaw.
(CVE-2010-2239)

Jeremy Nickurak discovered that libvirt created iptables rules with too lenient mappings of source ports. A privileged attacker in the guest could bypass intended restrictions to access privileged resources on the host. (CVE-2010-2242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A reboot is required to update the iptables rules for the default virtual network to address the CVE-2010-2242 All disk format probing is now disabled in a default installation of libvirt. This change may prevent KVM guests using qcow2 disks from booting successfully. If this occurs verify that the guest XML <disk> element has explicitly requested use of the qcow2 data format via the <driver> element:
<driver name='qemu' type='qcow2'/> If the qcow2 is using an external backing file, it may be necessary to re-create the qcow2 file, explicitly specifying the backing store format with the '-o' option.
qemu- img create -f qcow2 -b master.qcow2 -o backing_fmt=qcow2 newdisk.qcow2 If this is not possible, disk format probing can be re-enabled via /etc/libvirt/qemu.conf allow_disk_format_probing = 1 NB, enabling disk format probing has security consequences as per the linked CVEs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75622	openSUSE Security Update : libvirt (openSUSE-SU-2010:0625-1)	Nessus	SuSE Local Security Checks	medium
51624	SuSE 11.1 Security Update : libvirt (SAT Patch Number 2957)	Nessus	SuSE Local Security Checks	medium
50524	Ubuntu 10.04 LTS : libvirt regression (USN-1008-4)	Nessus	Ubuntu Local Security Checks	medium
50319	Ubuntu 10.04 LTS : libvirt update (USN-1008-3)	Nessus	Ubuntu Local Security Checks	medium
50301	Ubuntu 10.04 LTS : virtinst update (USN-1008-2)	Nessus	Ubuntu Local Security Checks	medium
50300	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : libvirt vulnerabilities (USN-1008-1)	Nessus	Ubuntu Local Security Checks	medium
49266	openSUSE Security Update : libvirt (openSUSE-SU-2010:0620-1)	Nessus	SuSE Local Security Checks	medium
47839	Fedora 12 : libvirt-0.8.2-1.fc12 (2010-11021)	Nessus	Fedora Local Security Checks	medium
47838	Fedora 13 : libvirt-0.8.2-1.fc13 (2010-10960)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-2237

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium