The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2867-1 advisory.

    It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon     was restarted. This could result in an unintended firewall configuration. This issue only applied to     Ubuntu 12.04 LTS. (CVE-2011-4600)

    Peter Krempa discovered that libvirt incorrectly handled locking when certain ACL checks failed. A local     attacker could use this issue to cause libvirt to stop responding, resulting in a denial of service. This     issue only applied to Ubuntu 14.04 LTS. (CVE-2014-8136)

    Luyao Huang discovered that libvirt incorrectly handled VNC passwords in shapshot and image files. A     remote authenticated user could use this issue to possibly obtain VNC passwords. This issue only affected     Ubuntu 14.04 LTS. (CVE-2015-0236)

    Han Han discovered that libvirt incorrectly handled volume creation failure when used with NFS. A remote     authenticated user could use this issue to cause libvirt to crash, resulting in a denial of service. This     issue only applied to Ubuntu 15.10. (CVE-2015-5247)

    Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly performed storage pool name     validation. A remote authenticated user could use this issue to bypass ACLs and gain access to unintended     files. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-5313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated libvirt packages fix security vulnerabilities :

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456).

libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179).

An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process (CVE-2014-3633).

A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive (CVE-2014-3657).

Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file (CVE-2014-7823).

The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136).

The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

Updated libvirt packages fixes security vulnerabilities :

The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136).

The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

The updated packages provides the latest 1.1.3.9 version whish has more robust fixes for MDVSA-2015:023 and MDVSA-2015:035.

It was found that QEMU's qemuDomainMigratePerform() and qemuDomainMigrateFinish2() functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial of service.
(CVE-2014-8136)

It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. (CVE-2015-0236)

Bug fixes :

  - The libvirtd daemon previously attempted to search for     SELinux contexts even when SELinux was disabled on the     host. Consequently, libvirtd logged 'Unable to lookup     SELinux process context' error messages every time a     client connected to libvirtd and SELinux was disabled.
    libvirtd now verifies whether SELinux is enabled before     searching for SELinux contexts, and no longer logs the     error messages on a host with SELinux disabled.

  - The libvirt utility passed incomplete PCI addresses to     QEMU. Consequently, assigning a PCI device that had a     PCI address with a non- zero domain to a guest failed.
    Now, libvirt properly passes PCI domain to QEMU when     assigning PCI devices, which prevents the described     problem.

  - Because the virDomainSetMaxMemory API did not allow     changing the current memory in the LXC driver, the     'virsh setmaxmem' command failed when attempting to set     the maximum memory to be lower than the current memory.
    Now, 'virsh setmaxmem' sets the current memory to the     intended value of the maximum memory, which avoids the     mentioned problem.

  - Attempting to start a non-existent domain caused network     filters to stay locked for read-only access. Because of     this, subsequent attempts to gain read-write access to     network filters triggered a deadlock. Network filters     are now properly unlocked in the described scenario, and     the deadlock no longer occurs.

  - If a guest configuration had an active nwfilter using     the DHCP snooping feature and an attempt was made to     terminate libvirtd before the associated nwfilter rule     snooped the guest IP address from DHCP packets, libvirtd     became unresponsive. This problem has been fixed by     setting a longer wait time for snooping the guest IP     address.

Enhancements :

  - A new 'migrate_host' option is now available in     /etc/libvirt/qemu.conf, which allows users to set a     custom IP address to be used for incoming migrations.

  - With this update, libvirt is able to create a compressed     memory-only crash dump of a QEMU domain. This type of     crash dump is directly readable by the GNU Debugger and     requires significantly less hard disk space than the     standard crash dump.

  - Support for reporting the NUMA node distance of the host     has been added to libvirt. This enhances the current     libvirt capabilities for reporting NUMA topology of the     host, and allows for easier optimization of new domains.

  - The XML file of guest and host capabilities generated by     the 'virsh capabilities' command has been enhanced to     list the following information, where relevant: the     interface speed and link status of the host, the PCI     Express (PCIe) details, the host's hardware support for     I/O virtualization, and a report on the huge memory     pages.

These packages also include a number of other bug fixes and enhancements.

Updated libvirt packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.

It was found that QEMU's qemuDomainMigratePerform() and qemuDomainMigrateFinish2() functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial of service.
(CVE-2014-8136)

It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. (CVE-2015-0236)

The CVE-2015-0236 issue was found by Luyao Huang of Red Hat.

Bug fixes :

* The libvirtd daemon previously attempted to search for SELinux contexts even when SELinux was disabled on the host. Consequently, libvirtd logged 'Unable to lookup SELinux process context' error messages every time a client connected to libvirtd and SELinux was disabled. libvirtd now verifies whether SELinux is enabled before searching for SELinux contexts, and no longer logs the error messages on a host with SELinux disabled. (BZ#1135155)

* The libvirt utility passed incomplete PCI addresses to QEMU.
Consequently, assigning a PCI device that had a PCI address with a non-zero domain to a guest failed. Now, libvirt properly passes PCI domain to QEMU when assigning PCI devices, which prevents the described problem. (BZ#1127080)

* Because the virDomainSetMaxMemory API did not allow changing the current memory in the LXC driver, the 'virsh setmaxmem' command failed when attempting to set the maximum memory to be lower than the current memory. Now, 'virsh setmaxmem' sets the current memory to the intended value of the maximum memory, which avoids the mentioned problem.
(BZ#1091132)

* Attempting to start a non-existent domain caused network filters to stay locked for read-only access. Because of this, subsequent attempts to gain read-write access to network filters triggered a deadlock.
Network filters are now properly unlocked in the described scenario, and the deadlock no longer occurs. (BZ#1088864)

* If a guest configuration had an active nwfilter using the DHCP snooping feature and an attempt was made to terminate libvirtd before the associated nwfilter rule snooped the guest IP address from DHCP packets, libvirtd became unresponsive. This problem has been fixed by setting a longer wait time for snooping the guest IP address.
(BZ#1075543)

Enhancements :

* A new 'migrate_host' option is now available in /etc/libvirt/qemu.conf, which allows users to set a custom IP address to be used for incoming migrations. (BZ#1087671)

* With this update, libvirt is able to create a compressed memory-only crash dump of a QEMU domain. This type of crash dump is directly readable by the GNU Debugger and requires significantly less hard disk space than the standard crash dump. (BZ#1035158)

* Support for reporting the NUMA node distance of the host has been added to libvirt. This enhances the current libvirt capabilities for reporting NUMA topology of the host, and allows for easier optimization of new domains. (BZ#1086331)

* The XML file of guest and host capabilities generated by the 'virsh capabilities' command has been enhanced to list the following information, where relevant: the interface speed and link status of the host, the PCI Express (PCIe) details, the host's hardware support for I/O virtualization, and a report on the huge memory pages.
(BZ#1076960, BZ#1076957, BZ#1076959, BZ#1076962)

These packages also include a number of other bug fixes and enhancements. For additional details, see the 'Bugs Fixed' section below.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0323 advisory.

    - qemu: migration: Unlock vm on failed ACL check in protocol v2 APIs (CVE-2014-8136)
    - CVE-2015-0236: qemu: Check ACLs when dumping security info from save image (CVE-2015-0236)
    - CVE-2015-0236: qemu: Check ACLs when dumping security info from snapshots (CVE-2015-0236)
    - CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats() (CVE-2014-8131)
    - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
    - domain_conf: fix domain deadlock (CVE-2014-3657)
    - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Rebased to version 1.1.3.9

    - CVE-2015-0236: missing ACL check for the       VIR_DOMAIN_XML_SECURE flag in save images and       snapshots objects (bz #1185769)

    - CVE-2014-8136: local denial of service in       qemu/qemu_driver.c (bz #1176179)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebased to version 1.2.9.2

    - CVE-2014-8131: deadlock and segfault in       qemuConnectGetAllDomainStats (bz #1172571)

    - CVE-2015-0236: missing ACL check for the       VIR_DOMAIN_XML_SECURE flag in save images and       snapshots objects (bz #1185769)

    - CVE-2014-8136: local denial of service in       qemu/qemu_driver.c (bz #1176179)

    - Fix crash parsing nbd URIs (bz #1188644)

    - Fix domain startup failing with 'strict' mode in       numatune (bz #1168672)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libvirt packages fix security vulnerability :

The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136).

- CVE-2014-8135: libvirt: local denial of service in     storage driver 87b9437f-CVE-2014-8135.patch bsc#910860

  - CVE-2014-8136: libvirt: local denial of service in qemu     driver 2bdcd29c-CVE-2014-8136.patch bsc#910862

  - CVE-2014-8131: Fix possible deadlock and segfault in     qemuConnectGetAllDomainStats()     57023c0a-CVE-2014-8131.patch,     cb104ef7-CVE-2014-8131.patch bsc#909274

  - Get /proc/sys/net/ipv[46] read-write for wicked to work     in containers. bsc#904432. ba9b7252-sys-net-rw.patch

  - Fix potential crasher in virt-aa-helper     2222123-virt-aa-helper-crash.patch

  - ip link add now needs the 'name' parameter.
    433b427-iplink-name.patch

  - Fixes for virt-sandbox-service to work :

  - Allow adding virt-sandbox service config to apparmor     rules. c264eea-virt-aa-helper-sandbox.patch

  - fix symlink resolving for containers to start.
    72fecf1-lxc-resolve-symlinks.patch

  - fix unmounting file system if it contains the source to     mount. e50457d-lxc-unmount-check.patch

  - Remove security_driver = 'none' in qemu config. This     completely disabled all security drivers instead of     probing them.

  - Changed default value of QEMU's     security_default_confined to 0 to keep QEMU domains     unconfined by default.

- CVE-2014-8136: libvirt: local denial of service in qemu     driver 2bdcd29c-CVE-2014-8136.patch bsc#910862

The remote host is affected by the vulnerability described in GLSA-201412-36 (libvirt: Denial of Service)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
87888	Ubuntu 14.04 LTS : libvirt vulnerabilities (USN-2867-1)	Nessus	Ubuntu Local Security Checks	medium
82368	Mandriva Linux Security Advisory : libvirt (MDVSA-2015:115)	Nessus	Mandriva Local Security Checks	medium
82323	Mandriva Linux Security Advisory : libvirt (MDVSA-2015:070)	Nessus	Mandriva Local Security Checks	low
82257	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	low
81887	CentOS 7 : libvirt (CESA-2015:0323)	Nessus	CentOS Local Security Checks	low
81801	Oracle Linux 7 : libvirt (ELSA-2015-0323)	Nessus	Oracle Linux Local Security Checks	critical
81628	RHEL 7 : libvirt (RHSA-2015:0323)	Nessus	Red Hat Local Security Checks	low
81392	Fedora 20 : libvirt-1.1.3.9-1.fc20 (2015-1883)	Nessus	Fedora Local Security Checks	low
81365	Fedora 21 : libvirt-1.2.9.2-1.fc21 (2015-1892)	Nessus	Fedora Local Security Checks	medium
80560	Mandriva Linux Security Advisory : libvirt (MDVSA-2015:023)	Nessus	Mandriva Local Security Checks	low
80355	openSUSE Security Update : libvirt (openSUSE-SU-2015:0008-1)	Nessus	SuSE Local Security Checks	medium
80354	openSUSE Security Update : libvirt (openSUSE-SU-2015:0006-1)	Nessus	SuSE Local Security Checks	low
80241	GLSA-201412-36 : libvirt: Denial of Service	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2014-8136

medium

Tenable Plugins

medium

medium

low

low

low

critical

low

low

medium

low

medium

low

medium