A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4687 advisory.

    - logging: restrict sockets to mode 0600 (Daniel P. Berrange)  [Orabug: 29861433]  {CVE-2019-10132}
    - locking: restrict sockets to mode 0600 (Daniel P. Berrange)  [Orabug: 29861433]  {CVE-2019-10132}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4688 advisory.

    - logging: restrict sockets to mode 0600 (Daniel P. Berrange)  [Orabug: 29861433]  {CVE-2019-10132}
    - locking: restrict sockets to mode 0600 (Daniel P. Berrange)  [Orabug: 29861433]  {CVE-2019-10132}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1268 advisory.

  - libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
(CVE-2019-11091)

Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

The virConnectGetDomainCapabilities() libvirt API accepts an 'emulatorbin' argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. (CVE-2019-10167)

It was discovered that libvirtd would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. (CVE-2019-10166)

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.(CVE-2019-10132)

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs accept an 'emulator' argument to specify the program providing emulation for a domain.
Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. (CVE-2019-10168)

It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process.
An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. (CVE-2019-10161)

Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127)

A flaw was found in the implementation of the 'fill buffer', a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1268 advisory.

    - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
    - locking: restrict sockets to mode 0600 (CVE-2019-10132)
    - logging: restrict sockets to mode 0600 (CVE-2019-10132)
    - cpu_x86: Do not cache microcode version (CVE-2018-12130, CVE-2018-12126, CVE-2018-11091, CVE-2018-12127)
    - qemu: Don't cache microcode version (CVE-2018-12130, CVE-2018-12126, CVE-2018-11091, CVE-2018-12127)
    - cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 (CVE-2018-12130, CVE-2018-12126, CVE-2018-11091,     CVE-2018-12127)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Failed to attache NEW rbd device to guest (bz #1672620)

  - PCI hostdev interface segfault (bz #1692053)

----

Fix systemd socket permissions (CVE-2019-10132) The virtlockd-admin.socket, virtlogd-admin.sock, virtlockd.socket & virtlogd.socket units must be restarted, if currently running. This can be done with a host reboot or systemctl commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel P. Berrange discovered that libvirt incorrectly handled socket permissions. A local attacker could possibly use this issue to access libvirt. (CVE-2019-10132)

It was discovered that libvirt incorrectly performed certain permission checks. A remote attacker could possibly use this issue to access the guest agent and cause a denial of service. This issue only affected Ubuntu 19.04. (CVE-2019-3886).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

These updates contain the libvirt adjustments, that pass through the new 'md-clear' CPU flag (bsc#1135273).

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

Security issues fixed: CVE-2019-10132: Reject clients unless their UID matches the server UID (bsc#1134348)

Non security issues fixed: delay global firewall setup if no networks are running (bsc#1133229)

add systemd-container dependency to qemu and lxc drivers (bsc#1136109)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1455 advisory.

    The Advanced Virtualization module provides the user-space component     for running virtual machines that use KVM in environments managed by Red     Hat products.

    Security Fix(es):

    * A flaw was found in the implementation of the fill buffer, a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page     fault, the execution will continue speculatively with incorrect data from the fill buffer while the data     is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)

    * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore     Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed     processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use     this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

    * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During     a load operation, the load port receives data from the memory or IO subsystem and then provides the data     to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an     attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)

    * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

    * libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for libvirt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.
In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es) :

* libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* libvirt terminates and core-dumps with SIGABRT as a result of a invalid pointer error trying to free memory in virNWFilterBindingDefFree() (BZ# 1702173)

Security Fix(es) :

  - libvirt: wrong permissions in systemd admin-sock due to     missing SocketMode parameter (CVE-2019-10132)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

  - libvirt terminates and core-dumps with SIGABRT as a     result of a invalid pointer error trying to free memory     in virNWFilterBindingDefFree()

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1264 advisory.

    - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
    - locking: restrict sockets to mode 0600 (CVE-2019-10132)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix systemd socket permissions (CVE-2019-10132) The virtlockd-admin.socket, virtlogd-admin.sock, virtlockd.socket & virtlogd.socket units must be restarted, if currently running. This can be done with a host reboot or systemctl commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1268 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1264 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * libvirt terminates and core-dumps with SIGABRT as a result of a invalid pointer error trying to free     memory in virNWFilterBindingDefFree() (BZ#1702173)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
180738	Oracle Linux 7 : libvirt (ELSA-2019-4687)	Nessus	Oracle Linux Local Security Checks	high
180687	Oracle Linux 7 : libvirt (ELSA-2019-4688)	Nessus	Oracle Linux Local Security Checks	high
145610	CentOS 8 : virt:rhel (CESA-2019:1268)	Nessus	CentOS Local Security Checks	high
128288	Amazon Linux 2 : libvirt (ALAS-2019-1274) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Amazon Linux Local Security Checks	high
127586	Oracle Linux 8 : virt:rhel (ELSA-2019-1268)	Nessus	Oracle Linux Local Security Checks	high
126531	Fedora 29 : libvirt (2019-9210998aaa)	Nessus	Fedora Local Security Checks	high
126066	Ubuntu 18.10 / 19.04 : libvirt vulnerabilities (USN-4021-1)	Nessus	Ubuntu Local Security Checks	high
125922	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2019:1490-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	high
125872	RHEL 8 : Advanced Virtualization (RHSA-2019:1455)	Nessus	Red Hat Local Security Checks	high
125552	CentOS 7 : libvirt (CESA-2019:1264)	Nessus	CentOS Local Security Checks	high
125448	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20190523)	Nessus	Scientific Linux Local Security Checks	high
125442	Oracle Linux 7 : libvirt (ELSA-2019-1264)	Nessus	Oracle Linux Local Security Checks	high
125426	Fedora 30 : libvirt (2019-5f105dd2b6)	Nessus	Fedora Local Security Checks	high
125384	RHEL 8 : virt:rhel (RHSA-2019:1268)	Nessus	Red Hat Local Security Checks	high
125381	RHEL 7 : libvirt (RHSA-2019:1264)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-10132

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high