libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)

  - Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3)     qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly     verify that the disk is attached, which allows remote read-only attackers to cause a denial of service     (libvirtd crash) via the virDomainDetachDeviceFlags command. (CVE-2013-6458)

  - libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and     hang) via a crafted XML document containing an XML external entity declaration in conjunction with an     entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an     XML External Entity (XXE) issue. NOTE: this issue was SPLIT per ADT3 due to different affected versions of     some vectors. CVE-2014-5177 is used for other API methods. (CVE-2014-0179)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

libvirt was updated to fix one security issue and several non-security issues.

This security issue was fixed :

  - CVE-2015-0236: libvirt allowed remote authenticated     users to obtain the VNC password by using the     VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot     to the virDomainSnapshotGetXMLDesc interface or (2)     image to the virDomainSaveImageGetXMLDesc interface.
    (bsc#914693)

  - CVE-2015-5313: path traversal vulnerability allowed     libvirtd process to write arbitrary files into file     system using root permissions (bsc#953110)

Theses non-security issues were fixed :

  - bsc#948686: Use PAUSED state for domains that are     starting up.

  - bsc#903757: Provide nodeGetSecurityModel implementation     in libxl.

  - bsc#938228: Set disk type to BLOCK when driver is not     tap or file.

  - bsc#948516: Fix profile_status to distinguish between     errors and unconfined domains.

  - bsc#936524: Fix error starting lxc containers with     direct interfaces.

  - bsc#921555: Fixed apparmor generated profile for PCI     hostdevs.

  - bsc#899334: Include additional upstream fixes for     systemd TerminateMachine.

  - bsc#921586: Fix security driver default settings in     /etc/libvirt/qemu.conf.

  - bsc#921355: Fixed a number of QEMU apparmor abstraction     problems.

  - bsc#911737: Additional fix for the case where security     labels aren't automatically set.

  - bsc#914297: Allow setting the URL of an SMT server to     use in place of SCC.

  - bsc#904432: Backported route definition changes.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2867-1 advisory.

    It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon     was restarted. This could result in an unintended firewall configuration. This issue only applied to     Ubuntu 12.04 LTS. (CVE-2011-4600)

    Peter Krempa discovered that libvirt incorrectly handled locking when certain ACL checks failed. A local     attacker could use this issue to cause libvirt to stop responding, resulting in a denial of service. This     issue only applied to Ubuntu 14.04 LTS. (CVE-2014-8136)

    Luyao Huang discovered that libvirt incorrectly handled VNC passwords in shapshot and image files. A     remote authenticated user could use this issue to possibly obtain VNC passwords. This issue only affected     Ubuntu 14.04 LTS. (CVE-2015-0236)

    Han Han discovered that libvirt incorrectly handled volume creation failure when used with NFS. A remote     authenticated user could use this issue to cause libvirt to crash, resulting in a denial of service. This     issue only applied to Ubuntu 15.10. (CVE-2015-5247)

    Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly performed storage pool name     validation. A remote authenticated user could use this issue to bypass ACLs and gain access to unintended     files. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-5313)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated libvirt packages fix security vulnerabilities :

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456).

libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179).

An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process (CVE-2014-3633).

A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive (CVE-2014-3657).

Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file (CVE-2014-7823).

The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136).

The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

Updated libvirt packages fixes security vulnerabilities :

The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136).

The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

The updated packages provides the latest 1.1.3.9 version whish has more robust fixes for MDVSA-2015:023 and MDVSA-2015:035.

It was found that QEMU's qemuDomainMigratePerform() and qemuDomainMigrateFinish2() functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial of service.
(CVE-2014-8136)

It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. (CVE-2015-0236)

Bug fixes :

  - The libvirtd daemon previously attempted to search for     SELinux contexts even when SELinux was disabled on the     host. Consequently, libvirtd logged 'Unable to lookup     SELinux process context' error messages every time a     client connected to libvirtd and SELinux was disabled.
    libvirtd now verifies whether SELinux is enabled before     searching for SELinux contexts, and no longer logs the     error messages on a host with SELinux disabled.

  - The libvirt utility passed incomplete PCI addresses to     QEMU. Consequently, assigning a PCI device that had a     PCI address with a non- zero domain to a guest failed.
    Now, libvirt properly passes PCI domain to QEMU when     assigning PCI devices, which prevents the described     problem.

  - Because the virDomainSetMaxMemory API did not allow     changing the current memory in the LXC driver, the     'virsh setmaxmem' command failed when attempting to set     the maximum memory to be lower than the current memory.
    Now, 'virsh setmaxmem' sets the current memory to the     intended value of the maximum memory, which avoids the     mentioned problem.

  - Attempting to start a non-existent domain caused network     filters to stay locked for read-only access. Because of     this, subsequent attempts to gain read-write access to     network filters triggered a deadlock. Network filters     are now properly unlocked in the described scenario, and     the deadlock no longer occurs.

  - If a guest configuration had an active nwfilter using     the DHCP snooping feature and an attempt was made to     terminate libvirtd before the associated nwfilter rule     snooped the guest IP address from DHCP packets, libvirtd     became unresponsive. This problem has been fixed by     setting a longer wait time for snooping the guest IP     address.

Enhancements :

  - A new 'migrate_host' option is now available in     /etc/libvirt/qemu.conf, which allows users to set a     custom IP address to be used for incoming migrations.

  - With this update, libvirt is able to create a compressed     memory-only crash dump of a QEMU domain. This type of     crash dump is directly readable by the GNU Debugger and     requires significantly less hard disk space than the     standard crash dump.

  - Support for reporting the NUMA node distance of the host     has been added to libvirt. This enhances the current     libvirt capabilities for reporting NUMA topology of the     host, and allows for easier optimization of new domains.

  - The XML file of guest and host capabilities generated by     the 'virsh capabilities' command has been enhanced to     list the following information, where relevant: the     interface speed and link status of the host, the PCI     Express (PCIe) details, the host's hardware support for     I/O virtualization, and a report on the huge memory     pages.

These packages also include a number of other bug fixes and enhancements.

Updated libvirt packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.

It was found that QEMU's qemuDomainMigratePerform() and qemuDomainMigrateFinish2() functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial of service.
(CVE-2014-8136)

It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. (CVE-2015-0236)

The CVE-2015-0236 issue was found by Luyao Huang of Red Hat.

Bug fixes :

* The libvirtd daemon previously attempted to search for SELinux contexts even when SELinux was disabled on the host. Consequently, libvirtd logged 'Unable to lookup SELinux process context' error messages every time a client connected to libvirtd and SELinux was disabled. libvirtd now verifies whether SELinux is enabled before searching for SELinux contexts, and no longer logs the error messages on a host with SELinux disabled. (BZ#1135155)

* The libvirt utility passed incomplete PCI addresses to QEMU.
Consequently, assigning a PCI device that had a PCI address with a non-zero domain to a guest failed. Now, libvirt properly passes PCI domain to QEMU when assigning PCI devices, which prevents the described problem. (BZ#1127080)

* Because the virDomainSetMaxMemory API did not allow changing the current memory in the LXC driver, the 'virsh setmaxmem' command failed when attempting to set the maximum memory to be lower than the current memory. Now, 'virsh setmaxmem' sets the current memory to the intended value of the maximum memory, which avoids the mentioned problem.
(BZ#1091132)

* Attempting to start a non-existent domain caused network filters to stay locked for read-only access. Because of this, subsequent attempts to gain read-write access to network filters triggered a deadlock.
Network filters are now properly unlocked in the described scenario, and the deadlock no longer occurs. (BZ#1088864)

* If a guest configuration had an active nwfilter using the DHCP snooping feature and an attempt was made to terminate libvirtd before the associated nwfilter rule snooped the guest IP address from DHCP packets, libvirtd became unresponsive. This problem has been fixed by setting a longer wait time for snooping the guest IP address.
(BZ#1075543)

Enhancements :

* A new 'migrate_host' option is now available in /etc/libvirt/qemu.conf, which allows users to set a custom IP address to be used for incoming migrations. (BZ#1087671)

* With this update, libvirt is able to create a compressed memory-only crash dump of a QEMU domain. This type of crash dump is directly readable by the GNU Debugger and requires significantly less hard disk space than the standard crash dump. (BZ#1035158)

* Support for reporting the NUMA node distance of the host has been added to libvirt. This enhances the current libvirt capabilities for reporting NUMA topology of the host, and allows for easier optimization of new domains. (BZ#1086331)

* The XML file of guest and host capabilities generated by the 'virsh capabilities' command has been enhanced to list the following information, where relevant: the interface speed and link status of the host, the PCI Express (PCIe) details, the host's hardware support for I/O virtualization, and a report on the huge memory pages.
(BZ#1076960, BZ#1076957, BZ#1076959, BZ#1076962)

These packages also include a number of other bug fixes and enhancements. For additional details, see the 'Bugs Fixed' section below.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0323 advisory.

    - qemu: migration: Unlock vm on failed ACL check in protocol v2 APIs (CVE-2014-8136)
    - CVE-2015-0236: qemu: Check ACLs when dumping security info from save image (CVE-2015-0236)
    - CVE-2015-0236: qemu: Check ACLs when dumping security info from snapshots (CVE-2015-0236)
    - CVE-2014-8131: Fix possible deadlock and segfault in qemuConnectGetAllDomainStats() (CVE-2014-8131)
    - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
    - domain_conf: fix domain deadlock (CVE-2014-3657)
    - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Rebased to version 1.1.3.9

    - CVE-2015-0236: missing ACL check for the       VIR_DOMAIN_XML_SECURE flag in save images and       snapshots objects (bz #1185769)

    - CVE-2014-8136: local denial of service in       qemu/qemu_driver.c (bz #1176179)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebased to version 1.2.9.2

    - CVE-2014-8131: deadlock and segfault in       qemuConnectGetAllDomainStats (bz #1172571)

    - CVE-2015-0236: missing ACL check for the       VIR_DOMAIN_XML_SECURE flag in save images and       snapshots objects (bz #1185769)

    - CVE-2014-8136: local denial of service in       qemu/qemu_driver.c (bz #1176179)

    - Fix crash parsing nbd URIs (bz #1188644)

    - Fix domain startup failing with 'strict' mode in       numatune (bz #1168672)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - CVE-2015-0236: libvirt: access control bypass bsc#914693

  - bnc#905086: libvirt cannot properly determine cpu flags     with qemu-kvm

  - Fixed allowing devices for containers.

Updated libvirt packages fix security vulnerability :

The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

ID	Name	Product	Family	Severity
199214	RHEL 5 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
88560	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:0304-1)	Nessus	SuSE Local Security Checks	low
87888	Ubuntu 14.04 LTS : libvirt vulnerabilities (USN-2867-1)	Nessus	Ubuntu Local Security Checks	medium
82368	Mandriva Linux Security Advisory : libvirt (MDVSA-2015:115)	Nessus	Mandriva Local Security Checks	medium
82323	Mandriva Linux Security Advisory : libvirt (MDVSA-2015:070)	Nessus	Mandriva Local Security Checks	low
82257	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	low
81887	CentOS 7 : libvirt (CESA-2015:0323)	Nessus	CentOS Local Security Checks	low
81801	Oracle Linux 7 : libvirt (ELSA-2015-0323)	Nessus	Oracle Linux Local Security Checks	critical
81628	RHEL 7 : libvirt (RHSA-2015:0323)	Nessus	Red Hat Local Security Checks	low
81392	Fedora 20 : libvirt-1.1.3.9-1.fc20 (2015-1883)	Nessus	Fedora Local Security Checks	low
81365	Fedora 21 : libvirt-1.2.9.2-1.fc21 (2015-1892)	Nessus	Fedora Local Security Checks	medium
81238	openSUSE Security Update : libvirt (openSUSE-2015-112)	Nessus	SuSE Local Security Checks	low
81235	Mandriva Linux Security Advisory : libvirt (MDVSA-2015:035)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2015-0236

critical

Tenable Plugins

high

low

medium

medium

low

low

low

critical

low

low

medium

low

low