The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.

- Rebased to version 1.2.9.2

    - CVE-2014-8131: deadlock and segfault in       qemuConnectGetAllDomainStats (bz #1172571)

    - CVE-2015-0236: missing ACL check for the       VIR_DOMAIN_XML_SECURE flag in save images and       snapshots objects (bz #1185769)

    - CVE-2014-8136: local denial of service in       qemu/qemu_driver.c (bz #1176179)

    - Fix crash parsing nbd URIs (bz #1188644)

    - Fix domain startup failing with 'strict' mode in       numatune (bz #1168672)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2014-8135: libvirt: local denial of service in     storage driver 87b9437f-CVE-2014-8135.patch bsc#910860

  - CVE-2014-8136: libvirt: local denial of service in qemu     driver 2bdcd29c-CVE-2014-8136.patch bsc#910862

  - CVE-2014-8131: Fix possible deadlock and segfault in     qemuConnectGetAllDomainStats()     57023c0a-CVE-2014-8131.patch,     cb104ef7-CVE-2014-8131.patch bsc#909274

  - Get /proc/sys/net/ipv[46] read-write for wicked to work     in containers. bsc#904432. ba9b7252-sys-net-rw.patch

  - Fix potential crasher in virt-aa-helper     2222123-virt-aa-helper-crash.patch

  - ip link add now needs the 'name' parameter.
    433b427-iplink-name.patch

  - Fixes for virt-sandbox-service to work :

  - Allow adding virt-sandbox service config to apparmor     rules. c264eea-virt-aa-helper-sandbox.patch

  - fix symlink resolving for containers to start.
    72fecf1-lxc-resolve-symlinks.patch

  - fix unmounting file system if it contains the source to     mount. e50457d-lxc-unmount-check.patch

  - Remove security_driver = 'none' in qemu config. This     completely disabled all security drivers instead of     probing them.

  - Changed default value of QEMU's     security_default_confined to 0 to keep QEMU domains     unconfined by default.

The remote host is affected by the vulnerability described in GLSA-201412-36 (libvirt: Denial of Service)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
81365	Fedora 21 : libvirt-1.2.9.2-1.fc21 (2015-1892)	Nessus	Fedora Local Security Checks	medium
80355	openSUSE Security Update : libvirt (openSUSE-SU-2015:0008-1)	Nessus	SuSE Local Security Checks	medium
80241	GLSA-201412-36 : libvirt: Denial of Service	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2014-8131

critical

Tenable Plugins

medium

medium

medium