libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0127 advisory.

    [0.8.2-29.0.1.el5]
    - Replaced docs/et.png in tarball
    - remove virshtest from test cases to fix failure in mock build root

    [libvirt-0.8.2-29.el5]
    - Coverity pointed out an use after free in the fix for 816601 (rhbz#772848)

    [libvirt-0.8.2-28.el5]
    - qemu: Rollback on used USB devices (rhbz#816601)
    - qemu: Don't delete USB device on failed qemuPrepareHostdevUSBDevices (rhbz#816601)

    [libvirt-0.8.2-27.el5]
    - qemu: Delete USB devices used by domain on stop (rhbz#816601)

    [libvirt-0.8.2-26.el5]
    - Fix off-by-1 in virFileAbsPath. (rhbz#680289)
    - Fix autostart flag when loading running domains (rhbz#675319)
    - node_device: Avoid null dereference on error (rhbz#772848)
    - util: Avoid null deref on qcowXGetBackingStore (rhbz#772848)
    - docs: Improve virsh domxml-*-native command docs (rhbz#783001)
    - Clarify the purpose of domxml-from-native (rhbz#783001)
    - qemu: Add return value check (rhbz#772821)
    - storage: Avoid mishandling backing store > 2GB (rhbz#772821)
    - util: Avoid PATH_MAX-sized array (rhbz#816601)
    - qemu: Keep list of USB devices attached to domains (rhbz#816601)
    - qemu: Don't leak temporary list of USB devices (rhbz#816601)
    - usb: Create functions to search usb device accurately (rhbz#816601)
    - qemu: Call usb search function for hostdev initialization and hotplug (rhbz#816601)
    - usb: Fix crash when failing to attach a second usb device (rhbz#816601)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated libvirt packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Bus and device IDs were ignored when attempting to attach multiple USB devices with identical vendor or product IDs to a guest. This could result in the wrong device being attached to a guest, giving that guest root access to the device. (CVE-2012-2693)

This update also fixes the following bugs :

* Previously, the libvirtd library failed to set the autostart flags for already defined QEMU domains. This bug has been fixed, and the domains can now be successfully marked as autostarted. (BZ#675319)

* Prior to this update, the virFileAbsPath() function was not taking into account the slash ('/') directory separator when allocating memory for combining the cwd() function and a path. This behavior could lead to a memory corruption. With this update, a transformation to the virAsprintff() function has been introduced into virFileAbsPath(). As a result, the aforementioned behavior no longer occurs. (BZ#680289)

* With this update, a man page of the virsh user interface has been enhanced with information on the 'domxml-from-native' and 'domxml-to-native' commands. A correct notation of the format argument has been clarified. As a result, confusion is avoided when setting the format argument in the described commands. (BZ#783001)

All users of libvirt are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, libvirtd will be restarted automatically.

Bus and device IDs were ignored when attempting to attach multiple USB devices with identical vendor or product IDs to a guest. This could result in the wrong device being attached to a guest, giving that guest root access to the device. (CVE-2012-2693)

This update also fixes the following bugs :

  - Previously, the libvirtd library failed to set the     autostart flags for already defined QEMU domains. This     bug has been fixed, and the domains can now be     successfully marked as autostarted.

  - Prior to this update, the virFileAbsPath() function was     not taking into account the slash ('/') directory     separator when allocating memory for combining the cwd()     function and a path. This behavior could lead to a     memory corruption. With this update, a transformation to     the virAsprintff() function has been introduced into     virFileAbsPath(). As a result, the aforementioned     behavior no longer occurs.

  - With this update, a man page of the virsh user interface     has been enhanced with information on the     'domxml-from-native' and 'domxml-to-native' commands. A     correct notation of the format argument has been     clarified. As a result, confusion is avoided when     setting the format argument in the described commands.

After installing the updated packages, libvirtd will be restarted automatically.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Bus and device IDs were ignored when attempting to attach multiple USB devices with identical vendor or product IDs to a guest. This could result in the wrong device being attached to a guest, giving that guest root access to the device. (CVE-2012-2693)

These updated libvirt packages include numerous bug fixes and enhancements.

All users of libvirt are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

Updated libvirt packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Bus and device IDs were ignored when attempting to attach multiple USB devices with identical vendor or product IDs to a guest. This could result in the wrong device being attached to a guest, giving that guest root access to the device. (CVE-2012-2693)

These updated libvirt packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.

All users of libvirt are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0748 advisory.

  - libvirt: address bus= device= when identicle vendor ID/product IDs usb devices attached are ignored     (CVE-2012-2693)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
68698	Oracle Linux 5 : libvirt (ELSA-2013-0127)	Nessus	Oracle Linux Local Security Checks	critical
68547	Oracle Linux 6 : libvirt (ELSA-2012-0748)	Nessus	Oracle Linux Local Security Checks	critical
64073	RHEL 5 : libvirt (RHSA-2013:0127)	Nessus	Red Hat Local Security Checks	low
63598	Scientific Linux Security Update : libvirt on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	low
63572	CentOS 5 : libvirt (CESA-2013:0127)	Nessus	CentOS Local Security Checks	low
61340	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20120620)	Nessus	Scientific Linux Local Security Checks	low
59918	CentOS 6 : libvirt (CESA-2012:0748)	Nessus	CentOS Local Security Checks	low
59584	RHEL 6 : libvirt (RHSA-2012:0748)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2012-2693

critical

Tenable Plugins

critical

critical

low

low

low

low

low

critical