Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3)     qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly     verify that the disk is attached, which allows remote read-only attackers to cause a denial of service     (libvirtd crash) via the virDomainDetachDeviceFlags command. (CVE-2013-6458)

  - libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and     hang) via a crafted XML document containing an XML external entity declaration in conjunction with an     entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an     XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of     some vectors. CVE-2014-5177 is used for other API methods. (CVE-2014-0179)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201412-04 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service or cause       information leakage. A local attacker may be able to escalate privileges,       cause a Denial of Service or possibly execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

This update fixes the following security and non security issues with libvirt :

  - bnc#857492: Fix libvirtd crash when hot-plugging disks     for qemu domains (CVE-2013-6458)

  - bnc#858817: Don't crash if a connection closes early     (CVE-2014-1447)

  - bnc#858824: avoid crashing libvirtd when calling `virsh     numatune' on inactive Xen libxl domain (CVE-2013-6457)

  - bnc#859051: filter global events by domain:getattr ACL     (CVE-2014-0028)

  - bnc#817407: Add CAP_SYS_PACCT capability to libvirtd     AppArmor profile

  - bnc#859041: Following the upstream pattern, introduce     the daemon-config-network subpackage to handle defining     the default network

  - bnc#857271: Fix initialization of emulated NICs

  - bnc#857271: Fix potential segfault in libxl driver when     domain create fails

This update fixes the following security issues with libvirt :

  - bnc#857492: Fix libvirtd crash when hot-plugging disks     for qemu domains (CVE-2013-6458)

  - bnc#858817: Don't crash if a connection closes early     (CVE-2014-1447)

This update fixes the following one non-security and two security issues with libvirt :

  - Fixing device assignment problem with Broadcom 57810 NIC     to Guest OS. (bnc#817407)

  - qemu job usage issue in several API leading to libvirtd     crash. (CVE-2013-6458). (bnc#857492)

  - denial of service with keepalive (CVE-2014-1447).
    (bnc#858817)

Martin Kletzander discovered that libvirt incorrectly handled reading memory tunables from LXC guests. A local user could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service.
This issue only affected Ubuntu 13.10. (CVE-2013-6436)

Dario Faggioli discovered that libvirt incorrectly handled the libxl driver. A local user could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 13.10. (CVE-2013-6457)

It was discovered that libvirt contained multiple race conditions in block device handling. A remote read-only user could use this flaw to cause libvirtd to crash, resulting in a denial of service.
(CVE-2013-6458)

Eric Blake discovered that libvirt incorrectly handled certain ACLs.
An attacker could use this flaw to possibly obtain certain sensitive information. This issue only affected Ubuntu 13.10. (CVE-2014-0028)

Jiri Denemark discovered that libvirt incorrectly handled keepalives.
A remote attacker could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service. (CVE-2014-1447).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libvirt packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

A use-after-free flaw was found in the way several libvirt block APIs handled domain jobs. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, execute arbitrary code with the privileges of the libvirtd process (usually root). (CVE-2013-6458)

A race condition was found in the way libvirtd handled keepalive initialization requests when the connection was closed prior to establishing connection credentials. An attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd, resulting in a denial of service. (CVE-2014-1447)

This update also fixes the following bug :

* A race condition was possible between a thread starting a virtual machine with a guest agent configured (regular start-up or while migrating) and a thread that was killing the VM process (or the process crashing). The race could cause the monitor object to be freed by the thread that killed the VM process, which was later accessed by the thread that was attempting to start the VM, resulting in a crash.
This issue was fixed by checking the state of the VM after the attempted connection to the guest agent; if the VM in the meantime exited, no other operations are attempted. (BZ#1055578)

All libvirt users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, libvirtd will be restarted automatically.

A use-after-free flaw was found in the way several libvirt block APIs handled domain jobs. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, execute arbitrary code with the privileges of the libvirtd process (usually root). (CVE-2013-6458)

A race condition was found in the way libvirtd handled keepalive initialization requests when the connection was closed prior to establishing connection credentials. An attacker able to establish a read- only connection to libvirtd could use this flaw to crash libvirtd, resulting in a denial of service. (CVE-2014-1447)

This update also fixes the following bug :

  - A race condition was possible between a thread starting     a virtual machine with a guest agent configured (regular     start-up or while migrating) and a thread that was     killing the VM process (or the process crashing). The     race could cause the monitor object to be freed by the     thread that killed the VM process, which was later     accessed by the thread that was attempting to start the     VM, resulting in a crash. This issue was fixed by     checking the state of the VM after the attempted     connection to the guest agent; if the VM in the meantime     exited, no other operations are attempted.

After installing the updated packages, libvirtd will be restarted automatically.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0103 advisory.

    - qemu: Do not access stale data in virDomainBlockStats (CVE-2013-6458)
    - qemu: Avoid using stale data in virDomainGetBlockInfo (CVE-2013-6458)
    - qemu: Fix job usage in qemuDomainBlockJobImpl (CVE-2013-6458)
    - qemu: Fix job usage in virDomainGetBlockIoTune (CVE-2013-6458)
    - Don't crash if a connection closes early (CVE-2014-1447)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Rebased to version 1.0.5.9

    - Fix crash in virDBusAddWatch (bz #885445)

    - Cleanup migration ports when migration is cancelled       (bz #1018530)

    - CVE-2013-6458 libvirt: qemu: job usage issue in       several APIs leading to libvirtd crash (bz #1054206,       bz #1048631)

    - CVE-2013-6436 libvirt: crash in       lxcDomainGetMemoryParameters (bz #1049136, bz       #1042252)

    - CVE-2014-1447: libvirt: denial of service with       keepalive (bz 1052957, bz 1054808)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been found in Libvirt, a virtualisation abstraction library :

  - CVE-2013-6458     It was discovered that insecure job usage could lead to     denial of service against libvirtd.

  - CVE-2014-1447     It was discovered that a race condition in keepalive     handling could lead to denial of service against     libvirtd.

ID	Name	Product	Family	Severity
199214	RHEL 5 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
79814	GLSA-201412-04 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75266	openSUSE Security Update : libvirt (openSUSE-SU-2014:0268-1)	Nessus	SuSE Local Security Checks	medium
75263	openSUSE Security Update : libvirt (openSUSE-SU-2014:0270-1)	Nessus	SuSE Local Security Checks	medium
72769	SuSE 11.3 Security Update : libvirt (SAT Patch Number 8886)	Nessus	SuSE Local Security Checks	medium
72232	Ubuntu 12.04 LTS / 12.10 / 13.10 : libvirt vulnerabilities (USN-2093-1)	Nessus	Ubuntu Local Security Checks	medium
72205	CentOS 6 : libvirt (CESA-2014:0103)	Nessus	CentOS Local Security Checks	medium
72197	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20140128)	Nessus	Scientific Linux Local Security Checks	medium
72196	RHEL 6 : libvirt (RHSA-2014:0103)	Nessus	Red Hat Local Security Checks	medium
72195	Oracle Linux 6 : libvirt (ELSA-2014-0103)	Nessus	Oracle Linux Local Security Checks	critical
72137	Fedora 19 : libvirt-1.0.5.9-1.fc19 (2014-1090)	Nessus	Fedora Local Security Checks	medium
72011	Debian DSA-2846-1 : libvirt - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-6458

critical

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium