Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.

- Update to libvirt 0.9.11.9 stable release

  - Fixes CVE-2013-0170 by including cherry picked master     commit 46532e3e, bnc#800976

  - Fix starting lxc VM e.g from OpenStack bnc#793900 and     rh#858104

libvirt was updated to fix some bugs and security issues :

Security issues fixed :

  - Fix crash on error paths of message dispatching,     CVE-2013-0170 bnc#800976

  - security: Fix libvirtd crash possibility CVE-2012-4423     bnc#780432

Also bugs were fixed :

  - qemu: Fix probing for guest capabilities bnc#772586

  - xen-xm: Generate UUID if not specified bnc#773626

  - xenParseXM: don't dereference NULL pointer when script     is empty bnc#773621

The remote host is affected by the vulnerability described in GLSA-201309-18 (libvirt: Multiple vulnerabilities)

    An error in the virNetMessageFree() function in rpc/virnetserverclient.c       can lead to a use-after-free. Additionally, a socket leak in the       remoteDispatchStoragePoolListAllVolumes command can lead to file       descriptor exhaustion.
  Impact :

    A remote attacker could cause certain errors during an RPC connection to       cause a message to be freed without being removed from the message queue,       possibly resulting in execution of arbitrary code or a Denial of Service       condition. Additionally, a remote attacker could repeatedly issue the       command to list all pool volumes, causing a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2013:0199 :

Updated libvirt packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

A flaw was found in the way libvirtd handled connection cleanup (when a connection was being closed) under certain error conditions. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, execute arbitrary code with the privileges of the root user. (CVE-2013-0170)

This issue was discovered by Tingting Zheng of Red Hat.

All users of libvirt are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, libvirtd will be restarted automatically.

Updated libvirt packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

A flaw was found in the way libvirtd handled connection cleanup (when a connection was being closed) under certain error conditions. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, execute arbitrary code with the privileges of the root user. (CVE-2013-0170)

This issue was discovered by Tingting Zheng of Red Hat.

All users of libvirt are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, libvirtd will be restarted automatically.

libvirt was updated to fix the following security issue :

  - A flaw was found in the way message freeing on     connection cleanup was handled under certain error     conditions. A remote user able to issue commands to     libvirt daemon could use this flaw to crash libvirtd or,     potentially, escalate their privilages to that of     libvirtd process. (CVE-2013-0170)

Also following bug has been fixed :

  - Add managedSave functions to legacy xen driver     (bnc#782311)

- Rebased to version 0.9.6.4

    - CVE-2013-0170 libvirt: use-after-free in       virNetMessageFree() (bz #893450, bz #905173)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebased to version 0.9.11.9

    - CVE-2013-0170 libvirt: use-after-free in       virNetMessageFree() (bz #893450, bz #905173)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebased to version 0.10.2.3

    - Fix libxl driver to build against xen 4.2 (bz #870689)

    - Fix possible crash when destroying guests (bz #877110)

    - Fix loading sysctl file (bz #887017)

    - Fix svirt memory leak (bz #890039)

    - Fix attaching PCI netdev to VM (bz #893131)

    - Fix libvirtd segfault on shutdown (bz #903184)

    - Raise mem limit to stop qemu processes from getting       OOM killed (bz #903432)

    - CVE-2013-0170 libvirt: use-after-free in       virNetMessageFree() (bz #893450, bz #905173)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wenlong Huang discovered that libvirt incorrectly handled certain RPC calls. A remote attacker could exploit this and cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-4423)

Tingting Zheng discovered that libvirt incorrectly handled cleanup under certain error conditions. A remote attacker could exploit this and cause libvirt to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-0170).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way libvirtd handled connection cleanup (when a connection was being closed) under certain error conditions. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, execute arbitrary code with the privileges of the root user. (CVE-2013-0170)

After installing the updated packages, libvirtd will be restarted automatically.

ID	Name	Product	Family	Severity
74883	openSUSE Security Update : libvirt (openSUSE-SU-2013:0275-1)	Nessus	SuSE Local Security Checks	high
74880	openSUSE Security Update : libvirt (openSUSE-SU-2013:0274-1)	Nessus	SuSE Local Security Checks	high
70130	GLSA-201309-18 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68716	Oracle Linux 6 : libvirt (ELSA-2013-0199)	Nessus	Oracle Linux Local Security Checks	high
67096	CentOS 6 : libvirt (CESA-2013:0199)	Nessus	CentOS Local Security Checks	high
64781	SuSE 11.2 Security Update : libvirt (SAT Patch Number 7310)	Nessus	SuSE Local Security Checks	high
64497	Fedora 16 : libvirt-0.9.6.4-1.fc16 (2013-1642)	Nessus	Fedora Local Security Checks	high
64496	Fedora 17 : libvirt-0.9.11.9-1.fc17 (2013-1626)	Nessus	Fedora Local Security Checks	high
64477	Fedora 18 : libvirt-0.10.2.3-1.fc18 (2013-1644)	Nessus	Fedora Local Security Checks	high
64289	Ubuntu 12.04 LTS / 12.10 : libvirt vulnerabilities (USN-1708-1)	Nessus	Ubuntu Local Security Checks	high
64282	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20130128)	Nessus	Scientific Linux Local Security Checks	high
64280	RHEL 6 : libvirt (RHSA-2013:0199)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2013-0170

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high