An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.

According to the versions of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was     allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended     information or denial of service by causing libvirt to block. (CVE-2019-3886)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14097-1 advisory.

  - It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to     probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary     programs. (CVE-2019-10161)

  - An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was     allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended     information or denial of service by causing libvirt to block. (CVE-2019-3886)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Microarchitectural Store Buffer Data Sampling (MSBDS):
    Store buffers on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12126)

  - Microarchitectural Data Sampling Uncacheable Memory     (MDSUM): Uncacheable memory on some microprocessors     utilizing speculative execution may allow an     authenticated user to potentially enable information     disclosure via a side channel with local access. A list     of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2019-11091)

  - Microarchitectural Fill Buffer Data Sampling (MFBDS):
    Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12130)

  - Microarchitectural Load Port Data Sampling (MLPDS):
    Load ports on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12127)

  - An incorrect permissions check was discovered in     libvirt 4.8.0 and above. The readonly permission was     allowed to invoke APIs depending on the guest agent,     which could lead to potentially disclosing unintended     information or denial of service by causing libvirt to     block.(CVE-2019-3886)

  - libvirt version before 4.2.0-rc1 is vulnerable to a     resource exhaustion as a result of an incomplete fix     for CVE-2018-5748 that affects QEMU monitor but now     also triggered via QEMU guest agent.(CVE-2018-1064)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - Systems with microprocessors utilizing speculative     execution and speculative execution of memory reads     before the addresses of all prior memory writes are     known may allow unauthorized disclosure of information     to an attacker with local user access via a     side-channel analysis, aka Speculative Store Bypass     (SSB), Variant 4.(CVE-2018-3639)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Cannot start VM with a CBR 2.0 TPM device (bz #1712556)

  - libvirtd does not update VM .xml configurations after     virsh snapshot/blockcommit (bz #1722348)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Failed to attache NEW rbd device to guest (bz #1672620)

  - PCI hostdev interface segfault (bz #1692053)

----

Fix systemd socket permissions (CVE-2019-10132) The virtlockd-admin.socket, virtlogd-admin.sock, virtlockd.socket & virtlogd.socket units must be restarted, if currently running. This can be done with a host reboot or systemctl commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel P. Berrange discovered that libvirt incorrectly handled socket permissions. A local attacker could possibly use this issue to access libvirt. (CVE-2019-10132)

It was discovered that libvirt incorrectly performed certain permission checks. A remote attacker could possibly use this issue to access the guest agent and cause a denial of service. This issue only affected Ubuntu 19.04. (CVE-2019-3886).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

These updates contain the libvirt adjustments, that pass through the new 'md-clear' CPU flag (bsc#1135273).

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

Other security issues fixed: CVE-2019-3886: Fixed an information leak which allowed to retrieve the guest hostname under readonly mode (bsc#1131595).

qemu: Add support for using AES secret for SCSI hotplug

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An incorrect permissions check was discovered in     libvirt 4.8.0 and above. The readonly permission was     allowed to invoke APIs depending on the guest agent     which could lead to potentially disclosing unintended     information or denial of service by causing libvirt to     block.(CVE-2019-3886)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - An incorrect permissions check was discovered in     libvirt 4.8.0 and above. The readonly permission was     allowed to invoke APIs depending on the guest agent     which could lead to potentially disclosing unintended     information or denial of service by causing libvirt to     block.(CVE-2019-3886)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issue fixed :

CVE-2019-3886: Fixed an information leak which allowed to retrieve the guest hostname under readonly mode (bsc#1131595).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issues fixed :

  - CVE-2019-3840: Fixed a NULL pointer dereference     vulnerability in virJSONValueObjectHasKey function which     could have resulted in a remote denial of service via     the guest agent (bsc#1127458). 

  - CVE-2019-3886: Fixed an information leak which allowed     to retrieve the guest hostname under readonly mode     (bsc#1131595).

Other issue addressed :

  - cpu: add Skylake-Server and Skylake-Server-IBRS CPU     models (FATE#327261, bsc#1131955)

  - libxl: save current memory value after successful     balloon (bsc#1120813).

  - libxl: support Xen's max_grant_frames setting with     maxGrantFrames attribute on the xenbus controller     (bsc#1126325).

  - conf: add new 'xenbus' controller type

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libvirt fixes the following issues :

Security issues fixed :

CVE-2019-3840: Fixed a NULL pointer dereference vulnerability in virJSONValueObjectHasKey function which could have resulted in a remote denial of service via the guest agent (bsc#1127458).

CVE-2019-3886: Fixed an information leak which allowed to retrieve the guest hostname under readonly mode (bsc#1131595).

Other issue addressed: cpu: add Skylake-Server and Skylake-Server-IBRS CPU models (FATE#327261, bsc#1131955)

libxl: save current memory value after successful balloon (bsc#1120813).

libxl: support Xen's max_grant_frames setting with maxGrantFrames attribute on the xenbus controller (bsc#1126325).

conf: add new 'xenbus' controller type

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issue fixed :

CVE-2019-3840: Fixed a NULL pointer dereference vulnerability in virJSONValueObjectHasKey function which could have resulted in a remote denial of service via the guest agent (bsc#1127458).

CVE-2019-3886: Fixed an information leak which allowed to retrieve the guest hostname under readonly mode (bsc#1131595).

Other issues addressed: libxl: support Xen's max_grant_frames setting with maxGrantFrames attribute on the xenbus controller (bsc#1126325).

conf: added new 'xenbus' controller type

util: skip RDMA detection for non-PCI network devices (bsc#1112182).

qemu: don't use CAP_DAC_OVERRIDE capability if non-root (bsc#1125665).

qemu: fix issues related to restricted permissions on /dev/sev(bsc#1102604).

libxl: save current memory value after successful balloon (bsc#1120813).

libxl: Add support for soft reset. (bsc#1081516)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
171190	EulerOS 2.0 SP8 : libvirt (EulerOS-SA-2023-1348)	Nessus	Huawei Local Security Checks	medium
150625	SUSE SLES11 Security Update : libvirt (SUSE-SU-2019:14097-1)	Nessus	SuSE Local Security Checks	high
131621	EulerOS 2.0 SP2 : libvirt (EulerOS-SA-2019-2468)	Nessus	Huawei Local Security Checks	medium
126532	Fedora 30 : libvirt (2019-b2dfb13daf)	Nessus	Fedora Local Security Checks	high
126531	Fedora 29 : libvirt (2019-9210998aaa)	Nessus	Fedora Local Security Checks	high
126066	Ubuntu 18.10 / 19.04 : libvirt vulnerabilities (USN-4021-1)	Nessus	Ubuntu Local Security Checks	high
125763	SUSE SLES12 Security Update : libvirt (SUSE-SU-2019:1438-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	medium
125586	EulerOS Virtualization for ARM 64 3.0.2.0 : libvirt (EulerOS-SA-2019-1634)	Nessus	Huawei Local Security Checks	medium
125562	EulerOS Virtualization 3.0.1.0 : libvirt (EulerOS-SA-2019-1610)	Nessus	Huawei Local Security Checks	medium
125280	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2019:1285-1)	Nessus	SuSE Local Security Checks	medium
124402	openSUSE Security Update : libvirt (openSUSE-2019-1294)	Nessus	SuSE Local Security Checks	medium
124361	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2019:1042-1)	Nessus	SuSE Local Security Checks	medium
124082	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2019:0948-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2019-3886

medium

Tenable Plugins

medium

high

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium