Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1019 advisory.

    - Add missing checks for read only connections (CVE-2011-1146)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

libvirtd could crash if bogus parameters where passed to the VirDomainGetVcpus call (CVE-2011-2511).

From Red Hat Security Advisory 2011:1197 :

Updated libvirt packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems.

An integer overflow flaw was found in libvirtd's RPC call handling. An attacker able to establish read-only connections to libvirtd could trigger this flaw by calling virDomainGetVcpus() with specially crafted parameters, causing libvirtd to crash. (CVE-2011-2511)

This update also fixes the following bugs :

* Previously, when the 'virsh vol-create-from' command was run on an LVM (Logical Volume Manager) storage pool, performance of the command was very low and the operation consumed an excessive amount of time.
This bug has been fixed in the virStorageVolCreateXMLFrom() function, and the performance problem of the command no longer occurs.

* Due to a regression, libvirt used undocumented command line options, instead of the recommended ones. Consequently, the qemu-img utility used an invalid argument while creating an encrypted volume, and the process eventually failed. With this update, the bug in the backing format of the storage back end has been fixed, and encrypted volumes can now be created as expected. (BZ#726617)

* Due to a bug in the qemuAuditDisk() function, hot unplug failures were never audited, and a hot unplug success was audited as a failure.
This bug has been fixed, and auditing of disk hot unplug operations now works as expected. (BZ#728516)

* Previously, when a debug process was being activated, the act of preparing a debug message ended up with dereferencing a UUID (universally unique identifier) prior to the NULL argument check.
Consequently, an API running the debug process sometimes terminated with a segmentation fault. With this update, a patch has been provided to address this issue, and the crashes no longer occur in the described scenario. (BZ#728546)

* The libvirt library uses the 'boot=on' option to mark which disk is bootable but it only uses that option if Qemu advertises its support.
The qemu-kvm utility in Red Hat Enterprise Linux 6.1 removed support for that option and libvirt could not use it. As a consequence, when an IDE disk was added as the second storage with a virtio disk being set up as the first one by default, the operating system tried to boot from the IDE disk rather than the virtio disk and either failed to boot with the 'No bootable disk' error message returned, or the system booted whatever operating system was on the IDE disk. With this update, the boot configuration is translated into bootindex, which provides control over which device is used for booting a guest operating system, thus fixing this bug.

All users of libvirt are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1019 advisory.

    The libvirt library is a C API for managing and interacting with the     virtualization capabilities of Linux and other operating systems.

    An integer overflow flaw was found in libvirtd's RPC call handling. An     attacker able to establish read-only connections to libvirtd could trigger     this flaw by calling virDomainGetVcpus() with specially-crafted parameters,     causing libvirtd to crash. (CVE-2011-2511)

    This update fixes the following bugs:

    * libvirt was rebased from version 0.6.3 to version 0.8.2 in Red Hat     Enterprise Linux 5.6. A code audit found a minor API change that effected     error messages seen by libvirt 0.8.2 clients talking to libvirt 0.7.1     0.7.7 (0.7.x) servers. A libvirt 0.7.x server could send     VIR_ERR_BUILD_FIREWALL errors where a libvirt 0.8.2 client expected     VIR_ERR_CONFIG_UNSUPPORTED errors. In other circumstances, a libvirt 0.8.2     client saw a Timed out during operation message where it should see an     Invalid network filter error. This update adds a backported patch that     allows libvirt 0.8.2 clients to interoperate with the API as used by     libvirt 0.7.x servers, ensuring correct error messages are sent.
    (BZ#665075)

    * libvirt could crash if the maximum number of open file descriptors     (_SC_OPEN_MAX) grew larger than the FD_SETSIZE value because it accessed     file descriptors outside the bounds of the set. With this update the     maximum number of open file descriptors can no longer grow larger than the     FD_SETSIZE value. (BZ#665549)

    * A libvirt race condition was found. An array in the libvirt event     handlers was accessed with a lock temporarily released. In rare cases, if     one thread attempted to access this array but a second thread reallocated     the array before the first thread reacquired a lock, it could lead to the     first thread attempting to access freed memory, potentially causing libvirt     to crash. With this update libvirt no longer refers to the old array and,     consequently, behaves as expected. (BZ#671569)

    * Guests connected to a passthrough NIC would kernel panic if a     system_reset signal was sent through the QEMU monitor. With this update you     can reset such guests as expected. (BZ#689880)

    * When using the Xen kernel, the rpmbuild command failed on the xencapstest     test. With this update you can run rpmbuild successfully when using the Xen     kernel. (BZ#690459)

    * When a disk was hot unplugged, ret >= 0 was passed to the qemuAuditDisk     calls in disk hotunplug operations before ret was, in fact, set to 0. As     well, the error path jumped to the cleanup label prematurely. As a     consequence, hotunplug failures were not audited and hotunplug successes     were audited as failures. This was corrected and hot unplugging checks now     behave as expected. (BZ#710151)

    * A conflict existed between filter update locking sequences and virtual     machine startup locking sequences. When a filter update occurred on one or     more virtual machines, a deadlock could consequently occur if a virtual     machine referencing a filter was started. This update changes and makes     more flexible several qemu locking sequences ensuring this deadlock no     longer occurs. (BZ#697749)

    * qemudDomainSaveImageStartVM closed some incoming file descriptor (fd)     arguments without informing the caller. The consequent double-closes could     cause Domain restoration failure. This update alters the     qemudDomainSaveImageStartVM signature to prevent the double-closes.
    (BZ#681623)

    This update also adds the following enhancements:

    * The libvirt Xen driver now supports more than one serial port.
    (BZ#670789)

    * Enabling and disabling the High Precision Event Timer (HPET) in Xen     domains is now possible. (BZ#703193)

    All libvirt users should install this update which addresses this     vulnerability, fixes these bugs and adds these enhancements. After     installing the updated packages, libvirtd must be restarted (service     libvirtd restart) for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems.

An integer overflow flaw was found in libvirtd's RPC call handling. An attacker able to establish read-only connections to libvirtd could trigger this flaw by calling virDomainGetVcpus() with specially crafted parameters, causing libvirtd to crash. (CVE-2011-2511)

This update also fixes the following bugs :

  - Previously, when the 'virsh vol-create-from' command was     run on an LVM (Logical Volume Manager) storage pool,     performance of the command was very low and the     operation consumed an excessive amount of time. This bug     has been fixed in the virStorageVolCreateXMLFrom()     function, and the performance problem of the command no     longer occurs.

  - Due to a regression, libvirt used undocumented command     line options, instead of the recommended ones.
    Consequently, the qemu-img utility used an invalid     argument while creating an encrypted volume, and the     process eventually failed. With this update, the bug in     the backing format of the storage back end has been     fixed, and encrypted volumes can now be created as     expected.

  - Due to a bug in the qemuAuditDisk() function, hot unplug     failures were never audited, and a hot unplug success     was audited as a failure. This bug has been fixed, and     auditing of disk hot unplug operations now works as     expected.

  - Previously, when a debug process was being activated,     the act of preparing a debug message ended up with     dereferencing a UUID (universally unique identifier)     prior to the NULL argument check. Consequently, an API     running the debug process sometimes terminated with a     segmentation fault. With this update, a patch has been     provided to address this issue, and the crashes no     longer occur in the described scenario.

  - The libvirt library uses the 'boot=on' option to mark     which disk is bootable but it only uses that option if     Qemu advertises its support. The qemu-kvm utility in     Scientific Linux 6.1 removed support for that option and     libvirt could not use it. As a consequence, when an IDE     disk was added as the second storage with a virtio disk     being set up as the first one by default, the operating     system tried to boot from the IDE disk rather than the     virtio disk and either failed to boot with the 'No     bootable disk' error message returned, or the system     booted whatever operating system was on the IDE disk.
    With this update, the boot configuration is translated     into bootindex, which provides control over which device     is used for booting a guest operating system, thus     fixing this bug.

All users of libvirt are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.

An integer overflow flaw was found in libvirtd's RPC call handling. An attacker able to establish read-only connections to libvirtd could trigger this flaw by calling virDomainGetVcpus() with specially crafted parameters, causing libvirtd to crash. (CVE-2011-2511)

This update fixes the following bugs :

  - libvirt was rebased from version 0.6.3 to version 0.8.2     in Scientific Linux 5.6. A code audit found a minor API     change that effected error messages seen by libvirt     0.8.2 clients talking to libvirt 0.7.1 &#150; 0.7.7     (0.7.x) servers. A libvirt 0.7.x server could send     VIR_ERR_BUILD_FIREWALL errors where a libvirt 0.8.2     client expected VIR_ERR_CONFIG_UNSUPPORTED errors. In     other circumstances, a libvirt 0.8.2 client saw a 'Timed     out during operation' message where it should see an     'Invalid network filter' error. This update adds a     backported patch that allows libvirt 0.8.2 clients to     interoperate with the API as used by libvirt 0.7.x     servers, ensuring correct error messages are sent.

  - libvirt could crash if the maximum number of open file     descriptors (_SC_OPEN_MAX) grew larger than the     FD_SETSIZE value because it accessed file descriptors     outside the bounds of the set. With this update the     maximum number of open file descriptors can no longer     grow larger than the FD_SETSIZE value.

  - A libvirt race condition was found. An array in the     libvirt event handlers was accessed with a lock     temporarily released. In rare cases, if one thread     attempted to access this array but a second thread     reallocated the array before the first thread reacquired     a lock, it could lead to the first thread attempting to     access freed memory, potentially causing libvirt to     crash. With this update libvirt no longer refers to the     old array and, consequently, behaves as expected.

  - Guests connected to a passthrough NIC would kernel panic     if a system_reset signal was sent through the QEMU     monitor. With this update you can reset such guests as     expected.

  - When using the Xen kernel, the rpmbuild command failed     on the xencapstest test. With this update you can run     rpmbuild successfully when using the Xen kernel.

  - When a disk was hot unplugged, 'ret >= 0' was passed to     the qemuAuditDisk calls in disk hotunplug operations     before ret was, in fact, set to 0. As well, the error     path jumped to the 'cleanup' label prematurely. As a     consequence, hotunplug failures were not audited and     hotunplug successes were audited as failures. This was     corrected and hot unplugging checks now behave as     expected.

  - A conflict existed between filter update locking     sequences and virtual machine startup locking sequences.
    When a filter update occurred on one or more virtual     machines, a deadlock could consequently occur if a     virtual machine referencing a filter was started. This     update changes and makes more flexible several qemu     locking sequences ensuring this deadlock no longer     occurs.

  - qemudDomainSaveImageStartVM closed some incoming file     descriptor (fd) arguments without informing the caller.
    The consequent double-closes could cause Domain     restoration failure. This update alters the     qemudDomainSaveImageStartVM signature to prevent the     double-closes.

This update also adds the following enhancements :

  - The libvirt Xen driver now supports more than one serial     port.

  - Enabling and disabling the High Precision Event Timer     (HPET) in Xen domains is now possible.

All libvirt users should install this update which addresses this vulnerability, fixes these bugs and adds these enhancements. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201202-07 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow a remote attacker to cause a Denial of       Service condition on the host server or libvirt daemon, or  might allow       guest OS users to read arbitrary files on the host OS.
  Workaround :

    There is no known workaround at this time.

libvirtd could crash if bogus parameters where passed to the VirDomainGetVcpus call. (CVE-2011-2511)

Updated libvirt packages that fix one security issue, several bugs and add various enhancements are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.

An integer overflow flaw was found in libvirtd's RPC call handling. An attacker able to establish read-only connections to libvirtd could trigger this flaw by calling virDomainGetVcpus() with specially crafted parameters, causing libvirtd to crash. (CVE-2011-2511)

This update fixes the following bugs :

* libvirt was rebased from version 0.6.3 to version 0.8.2 in Red Hat Enterprise Linux 5.6. A code audit found a minor API change that effected error messages seen by libvirt 0.8.2 clients talking to libvirt 0.7.1 - 0.7.7 (0.7.x) servers. A libvirt 0.7.x server could send VIR_ERR_BUILD_FIREWALL errors where a libvirt 0.8.2 client expected VIR_ERR_CONFIG_UNSUPPORTED errors. In other circumstances, a libvirt 0.8.2 client saw a 'Timed out during operation' message where it should see an 'Invalid network filter' error. This update adds a backported patch that allows libvirt 0.8.2 clients to interoperate with the API as used by libvirt 0.7.x servers, ensuring correct error messages are sent. (BZ#665075)

* libvirt could crash if the maximum number of open file descriptors (_SC_OPEN_MAX) grew larger than the FD_SETSIZE value because it accessed file descriptors outside the bounds of the set. With this update the maximum number of open file descriptors can no longer grow larger than the FD_SETSIZE value. (BZ#665549)

* A libvirt race condition was found. An array in the libvirt event handlers was accessed with a lock temporarily released. In rare cases, if one thread attempted to access this array but a second thread reallocated the array before the first thread reacquired a lock, it could lead to the first thread attempting to access freed memory, potentially causing libvirt to crash. With this update libvirt no longer refers to the old array and, consequently, behaves as expected.
(BZ#671569)

* Guests connected to a passthrough NIC would kernel panic if a system_reset signal was sent through the QEMU monitor. With this update you can reset such guests as expected. (BZ#689880)

* When using the Xen kernel, the rpmbuild command failed on the xencapstest test. With this update you can run rpmbuild successfully when using the Xen kernel. (BZ#690459)

* When a disk was hot unplugged, 'ret >= 0' was passed to the qemuAuditDisk calls in disk hotunplug operations before ret was, in fact, set to 0. As well, the error path jumped to the 'cleanup' label prematurely. As a consequence, hotunplug failures were not audited and hotunplug successes were audited as failures. This was corrected and hot unplugging checks now behave as expected. (BZ#710151)

* A conflict existed between filter update locking sequences and virtual machine startup locking sequences. When a filter update occurred on one or more virtual machines, a deadlock could consequently occur if a virtual machine referencing a filter was started. This update changes and makes more flexible several qemu locking sequences ensuring this deadlock no longer occurs. (BZ#697749)

* qemudDomainSaveImageStartVM closed some incoming file descriptor (fd) arguments without informing the caller. The consequent double-closes could cause Domain restoration failure. This update alters the qemudDomainSaveImageStartVM signature to prevent the double-closes. (BZ#681623)

This update also adds the following enhancements :

* The libvirt Xen driver now supports more than one serial port.
(BZ#670789)

* Enabling and disabling the High Precision Event Timer (HPET) in Xen domains is now possible. (BZ#703193)

All libvirt users should install this update which addresses this vulnerability, fixes these bugs and adds these enhancements. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1197 advisory.

    The libvirt library is a C API for managing and interacting with the     virtualization capabilities of Linux and other operating systems. In     addition, libvirt provides tools for remotely managing virtualized systems.

    An integer overflow flaw was found in libvirtd's RPC call handling. An     attacker able to establish read-only connections to libvirtd could trigger     this flaw by calling virDomainGetVcpus() with specially-crafted parameters,     causing libvirtd to crash. (CVE-2011-2511)

    This update also fixes the following bugs:

    * Previously, when the virsh vol-create-from command was run on an LVM     (Logical Volume Manager) storage pool, performance of the command was very     low and the operation consumed an excessive amount of time. This bug has     been fixed in the virStorageVolCreateXMLFrom() function, and the     performance problem of the command no longer occurs.

    * Due to a regression, libvirt used undocumented command line options,     instead of the recommended ones. Consequently, the qemu-img utility used an     invalid argument while creating an encrypted volume, and the process     eventually failed. With this update, the bug in the backing format of the     storage back end has been fixed, and encrypted volumes can now be created     as expected. (BZ#726617)

    * Due to a bug in the qemuAuditDisk() function, hot unplug failures were     never audited, and a hot unplug success was audited as a failure. This bug     has been fixed, and auditing of disk hot unplug operations now works as     expected. (BZ#728516)

    * Previously, when a debug process was being activated, the act of     preparing a debug message ended up with dereferencing a UUID (universally     unique identifier) prior to the NULL argument check. Consequently, an API     running the debug process sometimes terminated with a segmentation fault.
    With this update, a patch has been provided to address this issue, and the     crashes no longer occur in the described scenario. (BZ#728546)

    * The libvirt library uses the boot=on option to mark which disk is     bootable but it only uses that option if Qemu advertises its support. The     qemu-kvm utility in Red Hat Enterprise Linux 6.1 removed support for that     option and libvirt could not use it. As a consequence, when an IDE disk was     added as the second storage with a virtio disk being set up as the first     one by default, the operating system tried to boot from the IDE disk rather     than the virtio disk and either failed to boot with the No bootable disk     error message returned, or the system booted whatever operating system was     on the IDE disk. With this update, the boot configuration is translated     into bootindex, which provides control over which device is used for     booting a guest operating system, thus fixing this bug.

    All users of libvirt are advised to upgrade to these updated packages,     which contain backported patches to correct these issues. After installing     the updated packages, libvirtd must be restarted (service libvirtd     restart) for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Eric Blake discovered an integer overflow flaw in libvirt. A remote authenticated attacker could exploit this by sending a crafted VCPU RPC call and cause a denial of service via application crash.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following bug was fixed in libvirt :

  - libvirtd could crash if bogus parameters where passed to     the VirDomainGetVcpus call. (CVE-2011-2511)

CVE-2011-2511, integer overflow in VirDomainGetVcpus

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libvirt, a library for interfacing with different virtualization systems, is prone to an integer overflow (CVE-2011-2511 ). Additionally, the stable version is prone to a denial of service, because its error reporting is not thread-safe (CVE-2011-1486 ).

Fix for CVE-2011-2178, regression introduced in disk probe logic,

Fix for CVE-2011-2511, integer overflow in VirDomainGetVcpus

Make commandtest more robust,

Add ARM to NUMA excludes

Add several build and runtime dependencies to specfile

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
181045	Oracle Linux 5 : libvirt (ELSA-2011-1019)	Nessus	Oracle Linux Local Security Checks	critical
75930	openSUSE Security Update : libvirt (openSUSE-SU-2011:0900-1)	Nessus	SuSE Local Security Checks	medium
75625	openSUSE Security Update : libvirt (openSUSE-SU-2011:0900-1)	Nessus	SuSE Local Security Checks	medium
68333	Oracle Linux 6 : libvirt (ELSA-2011-1197)	Nessus	Oracle Linux Local Security Checks	medium
63993	RHEL 5 : libvirt (RHSA-2011:1019)	Nessus	Red Hat Local Security Checks	critical
61119	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
61090	Scientific Linux Security Update : libvirt on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58139	GLSA-201202-07 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
57222	SuSE 10 Security Update : libvirt (ZYPP Patch Number 7616)	Nessus	SuSE Local Security Checks	medium
56264	CentOS 5 : libvirt (CESA-2011:1019)	Nessus	CentOS Local Security Checks	medium
55966	RHEL 6 : libvirt (RHSA-2011:1197)	Nessus	Red Hat Local Security Checks	critical
55850	SuSE 10 Security Update : libvirt (ZYPP Patch Number 7613)	Nessus	SuSE Local Security Checks	medium
55730	Ubuntu 10.04 LTS / 10.10 / 11.04 : libvirt vulnerability (USN-1180-1)	Nessus	Ubuntu Local Security Checks	medium
55696	SuSE 11.1 Security Update : libvirt (SAT Patch Number 4870)	Nessus	SuSE Local Security Checks	medium
55656	Fedora 14 : libvirt-0.8.3-10.fc14 (2011-9062)	Nessus	Fedora Local Security Checks	medium
55625	Debian DSA-2280-1 : libvirt - several vulnerabilities	Nessus	Debian Local Security Checks	medium
55561	Fedora 15 : libvirt-0.8.8-7.fc15 (2011-9091)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-2511

critical

Tenable Plugins

critical

medium

medium

medium

critical

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium