The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete     arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container;
    (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the     container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4)     virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under     /proc/$PID/root and the virInitctlSetRunLevel function. (CVE-2013-6456)

  - libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and     connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request     to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event     registration API. (CVE-2014-0028)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Updated libvirt packages fix security vulnerabilities :

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456).

libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179).

An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process (CVE-2014-3633).

A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive (CVE-2014-3657).

Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file (CVE-2014-7823).

The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136).

The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

The remote host is affected by the vulnerability described in GLSA-201412-04 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service or cause       information leakage. A local attacker may be able to escalate privileges,       cause a Denial of Service or possibly execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

libvirt was updated to fix various bugs and security issues :

CVE-2013-7336: libvirt: unprivileged user can crash libvirtd during spice migration

CVE-2013-6456: unsafe usage of paths under /proc/$PID/root

Bugfixes for libvirt client killed on reboot shutdown. (bnc#852005)

Also notify systemd when we are ready to accept connections.

libvirt has been patched to fix two security issues.

Further information is available at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0179 and http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6456

These security issues have been fixed :

  - Unsafe parsing of XML documents allows arbitrary file     read or denial of service. (CVE-2014-0179)

  - Ability to delete or create arbitrary host devices     (CVE-2013-6456)

Multiple vulnerabilities has been discovered and corrected in libvirt :

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456).

libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179).

The updated packages have been upgraded to the 1.1.3.5 version and patched to correct these issues.

It was discovered that libvirt incorrectly handled symlinks when using the LXC driver. An attacker could possibly use this issue to delete host devices, create arbitrary nodes, and shutdown or power off the host. (CVE-2013-6456)

Marian Krcmarik discovered that libvirt incorrectly handled seamless SPICE migrations. An attacker could possibly use this issue to cause a denial of service. (CVE-2013-7336).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebased to version 1.1.3.4

    - Fix domain events when ACLs are used (bz #1058839)

    - CVE-2013-6456: unsafe usage of paths under /proc//root       (bz #1048628, bz #1048627)

    - Fix baselineCPU EXPAND_FEATURES (bz #1049391)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199249	RHEL 7 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
82368	Mandriva Linux Security Advisory : libvirt (MDVSA-2015:115)	Nessus	Mandriva Local Security Checks	medium
79814	GLSA-201412-04 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75338	openSUSE Security Update : libvirt (openSUSE-SU-2014:0593-1)	Nessus	SuSE Local Security Checks	medium
74507	SuSE 11.3 Security Update : libvirt (SAT Patch Number 9203)	Nessus	SuSE Local Security Checks	medium
74075	Mandriva Linux Security Advisory : libvirt (MDVSA-2014:097)	Nessus	Mandriva Local Security Checks	medium
73940	Ubuntu 13.10 : libvirt vulnerabilities (USN-2209-1)	Nessus	Ubuntu Local Security Checks	medium
72753	Fedora 20 : libvirt-1.1.3.4-1.fc20 (2014-2864)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-6456

high

Tenable Plugins

high

medium

high

medium

medium

medium

medium

medium