The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap, as demonstrated by a large nodeset value to numatune.

The remote host is affected by the vulnerability described in GLSA-201412-04 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service or cause       information leakage. A local attacker may be able to escalate privileges,       cause a Denial of Service or possibly execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

libvirt was updated to fix security issues and bugs :

Security issues fixed: CVE-2013-4311: Add support for using 3-arg pkcheck syntax for process to avoid race conditions.

CVE-2013-4296: Fix a crash (denial of service) in remoteDispatchDomainMemoryStats

CVE-2013-5651: Fix virBitmapParse to avoid access beyond bounds of array (denial of service crash).

Also bugs were fixed :

  - nwfilter: check for inverted ctdir. bnc#810611

  - Add xencommons as 'Wanted' in the systemd libvirtd     service file. bnc#820888

libvirt has been updated to the 1.0.5.6 stable release that fixes bugs and security issues :

  - Fix crash in remoteDispatchDomainMemoryStats.
    (CVE-2013-4296)

  - virBitmapParse out-of-bounds read access Libvirt on SLES     11 SP3 is not affected:. (CVE-2013-5651)

  - Add support for using 3-arg pkcheck syntax for process     (). (CVE-2013-4311)

  - security: provide supplemental groups even when parsing     label () Changes in this version:. (CVE-2013-4291)

  - virsh: fix change-media bug on disk block type

  - Include process start time when doing polkit checks

  - qemuDomainChangeGraphics: Check listen address change by     listen type

  - python: return dictionary without value in case of no     blockjob

  - virbitmap: Refactor virBitmapParse to avoid access     beyond bounds of array Also the following bug has been     fixed :

  - Fix retrieval of SRIOV VF info, which prevented using     some SRIOV virtual functions in guest domains with ''     (bnc#837329)

- Fix snapshot restore when VM has disabled usb support     (bz #1011520)

    - Rebased to version 1.0.5.6

    - Fix blockjobinfo python API (bz #999077)

    - CVE-2013-4311: Insecure polkit usage (bz #1009539, bz       #1005332)

    - CVE-2013-4296: Invalid free memory stats (bz #1006173,       bz #1009667)

    - CVE-2013-4291: Supplementary groups handling (bz       #1006509, bz #1006511)

    - CVE-2013-5651: virBitmapParse out-of-bounds (bz       #1006493)

    - Fix virsh change-media with block disk type (bz       #951192)

    - Fix changing VNC listen address (bz #1006697)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libvirt used the pkcheck tool in an unsafe manner. A local attacker could possibly use this flaw to bypass polkit authentication. In Ubuntu, libvirt polkit authentication is not enabled by default. (CVE-2013-4311)

It was discovered that libvirt incorrectly handled certain memory stats requests. A remote attacker could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 12.10, and Ubuntu 13.04.
(CVE-2013-4296)

It was discovered that libvirt incorrectly handled certain bitmap operations. A remote attacker could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 13.04. (CVE-2013-5651).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79814	GLSA-201412-04 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75168	openSUSE Security Update : libvirt (openSUSE-SU-2013:1550-1)	Nessus	SuSE Local Security Checks	medium
70797	SuSE 11.3 Security Update : libvirt (SAT Patch Number 8421)	Nessus	SuSE Local Security Checks	medium
70279	Fedora 19 : libvirt-1.0.5.6-2.fc19 (2013-17618)	Nessus	Fedora Local Security Checks	medium
69972	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : libvirt vulnerabilities (USN-1954-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-5651

critical

Tenable Plugins

high

medium

medium

medium

medium