Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors.

libvirt did not properly handle configured disk formats which potenially allowed users to read arbitrary files (CVE-2010-2237, CVE-2010-2238, CVE-2010-2239)

Improperly mapped source privileged ports in guests may allow obtaining privileged resources on the host (CVE-2010-2242).

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0615 advisory.

    - Explicitly set qcow2 backing store format (CVE-2010-2239)
    - Remap privileged source ports from guests behind NAT (CVE-2010-2242)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0615 advisory.

    The libvirt library is a C API for managing and interacting with the     virtualization capabilities of Linux and other operating systems. In     addition, libvirt provides tools for remotely managing virtualized systems.

    It was found that libvirt did not set the user-defined backing store format     when creating a new image, possibly resulting in applications having to     probe the backing store to discover the format. A privileged guest user     could use this flaw to read arbitrary files on the host. (CVE-2010-2239)

    It was found that libvirt created insecure iptables rules on the host when     a guest system was configured for IP masquerading, allowing the guest to     use privileged ports on the host when accessing network resources. A     privileged guest user could use this flaw to access network resources that     would otherwise not be accessible to the guest. (CVE-2010-2242)

    Red Hat would like to thank Jeremy Nickurak for reporting the CVE-2010-2242     issue.

    This update also fixes the following bugs:

    * a Linux software bridge assumes the MAC address of the enslaved interface     with the numerically lowest MAC address. When the bridge changes its MAC     address, for a period of time it does not relay packets across network     segments, resulting in a temporary network blackout. The bridge should     thus avoid changing its MAC address in order not to disrupt network     communications.

    The Linux kernel assigns network TAP devices a random MAC address.
    Occasionally, this random MAC address is lower than that of the physical     interface which is enslaved (for example, eth0 or eth1), which causes the     bridge to change its MAC address, thereby disrupting network communications     for a period of time.

    With this update, libvirt now sets an explicit MAC address for all TAP     devices created using the configured MAC address from the XML, but with the     high bit set to 0xFE. The result is that TAP device MAC addresses are now     numerically greater than those for physical interfaces, and bridges should     no longer attempt to switch their MAC address to that of the TAP device,     thus avoiding potential spurious network disruptions. (BZ#617243)

    * a memory leak in the libvirt driver for the Xen hypervisor has been fixed     with this update. (BZ#619711)

    * the xm and virsh management user interfaces for virtual guests can be     called on the command line to list the number of active guests. However,     under certain circumstances, running the virsh list command resulted in     virsh not listing all of the virtual guests that were active (that is,     running) at the time. This update incorporates a fix that matches the logic     used for determining active guests with that of xm list, such that both     commands should now list the same number of active virtual guests under all     circumstances. (BZ#618200)

    All users of libvirt are advised to upgrade to these updated packages,     which contain backported patches to correct these issues. After installing     the updated packages, the system must be rebooted for the update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was found that libvirt did not set the user-defined backing store format when creating a new image, possibly resulting in applications having to probe the backing store to discover the format. A privileged guest user could use this flaw to read arbitrary files on the host.
(CVE-2010-2239)

It was found that libvirt created insecure iptables rules on the host when a guest system was configured for IP masquerading, allowing the guest to use privileged ports on the host when accessing network resources. A privileged guest user could use this flaw to access network resources that would otherwise not be accessible to the guest.
(CVE-2010-2242)

This update also fixes the following bugs :

  - a Linux software bridge assumes the MAC address of the     enslaved interface with the numerically lowest MAC     address. When the bridge changes its MAC address, for a     period of time it does not relay packets across network     segments, resulting in a temporary network 'blackout'.
    The bridge should thus avoid changing its MAC address in     order not to disrupt network communications.

The Linux kernel assigns network TAP devices a random MAC address.
Occasionally, this random MAC address is lower than that of the physical interface which is enslaved (for example, eth0 or eth1), which causes the bridge to change its MAC address, thereby disrupting network communications for a period of time.

With this update, libvirt now sets an explicit MAC address for all TAP devices created using the configured MAC address from the XML, but with the high bit set to 0xFE. The result is that TAP device MAC addresses are now numerically greater than those for physical interfaces, and bridges should no longer attempt to switch their MAC address to that of the TAP device, thus avoiding potential spurious network disruptions. (BZ#617243)

  - a memory leak in the libvirt driver for the Xen     hypervisor has been fixed with this update. (BZ#619711)

  - the xm and virsh management user interfaces for virtual     guests can be called on the command line to list the     number of active guests. However, under certain     circumstances, running the 'virsh list' command resulted     in virsh not listing all of the virtual guests that were     active (that is, running) at the time. This update     incorporates a fix that matches the logic used for     determining active guests with that of 'xm list', such     that both commands should now list the same number of     active virtual guests under all circumstances.
    (BZ#618200)

After installing the updated packages, the system must be rebooted for the update to take effect.

libvirt did not properly handle configured disk formats which potentially allowed users to read arbitrary files. (CVE-2010-2237 / CVE-2010-2238 / CVE-2010-2239)

Improperly mapped source privileged ports in guests may allow obtaining privileged resources on the host. (CVE-2010-2242)

In addition, fixes for the following non-security issues were included :

  - libvirt based kvm guest save operation takes too long.
    (bnc#614853)

  - With greater than 37 CPUs virt-manager throws     exceptions. (bnc#609738)

  - Stopping more than one VirtualDomain will fail.
    (bnc#594024)

  - Unable to install SLES 9 SP4 guest from CDs on KVM     system. (bnc#626070)

USN-1008-1 fixed vulnerabilities in libvirt. The upstream fixes for CVE-2010-2238 changed the behavior of libvirt such that the domain XML could not specify 'host_device' as the qemu sub-type. While libvirt 0.8.3 and later will longer support specifying this sub-type, this update restores the old behavior on Ubuntu 10.04 LTS.

We apologize for the inconvenience.

It was discovered that libvirt would probe disk backing stores without consulting the defined format for the disk. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 10.04 LTS. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2010-2237, CVE-2010-2238)

It was discovered that libvirt would create new VMs without setting a backing store format. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue did not affect Ubuntu 8.04 LTS. In Ubuntu 9.10 and later guests are confined by an AppArmor profile which provided partial protection against this flaw.
(CVE-2010-2239)

Jeremy Nickurak discovered that libvirt created iptables rules with too lenient mappings of source ports. A privileged attacker in the guest could bypass intended restrictions to access privileged resources on the host.
(CVE-2010-2242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1008-1 fixed vulnerabilities in libvirt. The update for Ubuntu 10.04 LTS reverted a recent bug fix update. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that libvirt would probe disk backing stores without consulting the defined format for the disk. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 10.04 LTS. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2010-2237, CVE-2010-2238)

It was discovered that libvirt would create new VMs without setting a backing store format. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue did not affect Ubuntu 8.04 LTS. In Ubuntu 9.10 and later guests are confined by an AppArmor profile which provided partial protection against this flaw.
(CVE-2010-2239)

Jeremy Nickurak discovered that libvirt created iptables rules with too lenient mappings of source ports. A privileged attacker in the guest could bypass intended restrictions to access privileged resources on the host.
(CVE-2010-2242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Libvirt in Ubuntu 10.04 LTS now no longer probes qemu disks for the image format and defaults to 'raw' when the format is not specified in the XML. This change in behavior breaks virt-install --import because virtinst in Ubuntu 10.04 LTS did not allow for specifying a disk format and does not specify a format in the XML. This update adds the 'format=' option when specifying a disk. For example, to import an existing VM which uses a qcow2 disk format, use somthing like the following :

virt-install --connect=qemu:///session --name test-import --ram=256 \
--disk path=<path to qcow2 image>,format=qcow2 --import

For more information, see man 1 virt-install.

It was discovered that libvirt would probe disk backing stores without consulting the defined format for the disk. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 10.04 LTS. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2010-2237, CVE-2010-2238)

It was discovered that libvirt would create new VMs without setting a backing store format. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue did not affect Ubuntu 8.04 LTS. In Ubuntu 9.10 and later guests are confined by an AppArmor profile which provided partial protection against this flaw.
(CVE-2010-2239)

Jeremy Nickurak discovered that libvirt created iptables rules with too lenient mappings of source ports. A privileged attacker in the guest could bypass intended restrictions to access privileged resources on the host.
(CVE-2010-2242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libvirt would probe disk backing stores without consulting the defined format for the disk. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 10.04 LTS. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2010-2237, CVE-2010-2238)

It was discovered that libvirt would create new VMs without setting a backing store format. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue did not affect Ubuntu 8.04 LTS. In Ubuntu 9.10 and later guests are confined by an AppArmor profile which provided partial protection against this flaw.
(CVE-2010-2239)

Jeremy Nickurak discovered that libvirt created iptables rules with too lenient mappings of source ports. A privileged attacker in the guest could bypass intended restrictions to access privileged resources on the host. (CVE-2010-2242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libvirt packages that fix two security issues and three bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems.

It was found that libvirt did not set the user-defined backing store format when creating a new image, possibly resulting in applications having to probe the backing store to discover the format. A privileged guest user could use this flaw to read arbitrary files on the host.
(CVE-2010-2239)

It was found that libvirt created insecure iptables rules on the host when a guest system was configured for IP masquerading, allowing the guest to use privileged ports on the host when accessing network resources. A privileged guest user could use this flaw to access network resources that would otherwise not be accessible to the guest.
(CVE-2010-2242)

Red Hat would like to thank Jeremy Nickurak for reporting the CVE-2010-2242 issue.

This update also fixes the following bugs :

* a Linux software bridge assumes the MAC address of the enslaved interface with the numerically lowest MAC address. When the bridge changes its MAC address, for a period of time it does not relay packets across network segments, resulting in a temporary network 'blackout'. The bridge should thus avoid changing its MAC address in order not to disrupt network communications.

The Linux kernel assigns network TAP devices a random MAC address.
Occasionally, this random MAC address is lower than that of the physical interface which is enslaved (for example, eth0 or eth1), which causes the bridge to change its MAC address, thereby disrupting network communications for a period of time.

With this update, libvirt now sets an explicit MAC address for all TAP devices created using the configured MAC address from the XML, but with the high bit set to 0xFE. The result is that TAP device MAC addresses are now numerically greater than those for physical interfaces, and bridges should no longer attempt to switch their MAC address to that of the TAP device, thus avoiding potential spurious network disruptions. (BZ#617243)

* a memory leak in the libvirt driver for the Xen hypervisor has been fixed with this update. (BZ#619711)

* the xm and virsh management user interfaces for virtual guests can be called on the command line to list the number of active guests.
However, under certain circumstances, running the 'virsh list' command resulted in virsh not listing all of the virtual guests that were active (that is, running) at the time. This update incorporates a fix that matches the logic used for determining active guests with that of 'xm list', such that both commands should now list the same number of active virtual guests under all circumstances. (BZ#618200)

All users of libvirt are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the system must be rebooted for the update to take effect.

A reboot is required to update the iptables rules for the default virtual network to address the CVE-2010-2242 All disk format probing is now disabled in a default installation of libvirt. This change may prevent KVM guests using qcow2 disks from booting successfully. If this occurs verify that the guest XML <disk> element has explicitly requested use of the qcow2 data format via the <driver> element:
<driver name='qemu' type='qcow2'/> If the qcow2 is using an external backing file, it may be necessary to re-create the qcow2 file, explicitly specifying the backing store format with the '-o' option.
qemu- img create -f qcow2 -b master.qcow2 -o backing_fmt=qcow2 newdisk.qcow2 If this is not possible, disk format probing can be re-enabled via /etc/libvirt/qemu.conf allow_disk_format_probing = 1 NB, enabling disk format probing has security consequences as per the linked CVEs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75622	openSUSE Security Update : libvirt (openSUSE-SU-2010:0625-1)	Nessus	SuSE Local Security Checks	medium
68082	Oracle Linux 5 : libvirt (ELSA-2010-0615)	Nessus	Oracle Linux Local Security Checks	critical
63943	RHEL 5 : libvirt (RHSA-2010:0615)	Nessus	Red Hat Local Security Checks	critical
60835	Scientific Linux Security Update : libvirt on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
51624	SuSE 11.1 Security Update : libvirt (SAT Patch Number 2957)	Nessus	SuSE Local Security Checks	medium
50524	Ubuntu 10.04 LTS : libvirt regression (USN-1008-4)	Nessus	Ubuntu Local Security Checks	medium
50319	Ubuntu 10.04 LTS : libvirt update (USN-1008-3)	Nessus	Ubuntu Local Security Checks	medium
50301	Ubuntu 10.04 LTS : virtinst update (USN-1008-2)	Nessus	Ubuntu Local Security Checks	medium
50300	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : libvirt vulnerabilities (USN-1008-1)	Nessus	Ubuntu Local Security Checks	medium
49266	openSUSE Security Update : libvirt (openSUSE-SU-2010:0620-1)	Nessus	SuSE Local Security Checks	medium
48302	CentOS 5 : libvirt (CESA-2010:0615)	Nessus	CentOS Local Security Checks	medium
47839	Fedora 12 : libvirt-0.8.2-1.fc12 (2010-11021)	Nessus	Fedora Local Security Checks	medium
47838	Fedora 13 : libvirt-0.8.2-1.fc13 (2010-10960)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-2239

critical

Tenable Plugins

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium