An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (CVE-2020-25637)

  - An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x     before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for     retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-     only connection to cause a memory leak in the domstats command, resulting in a potential denial of     service. (CVE-2020-12430)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3778 advisory.

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

  - An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x     before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for     retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-     only connection to cause a memory leak in the domstats command, resulting in a potential denial of     service. (CVE-2020-12430)

  - A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible     for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting to the read-write socket with limited ACL     permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or     potentially escalate their privileges on the system. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25637)

  - A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This     flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out     of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
    (CVE-2021-3631)

  - An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in     the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly     released on ACL permission failure. Clients connecting to the read-write socket with limited ACL     permissions could use this flaw to acquire the lock and prevent other users from accessing storage     pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability     is to system availability. (CVE-2021-3667)

  - A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in     qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a     monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is     shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial     of service attack by causing the libvirt daemon to crash. (CVE-2021-3975)

  - A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause     libvirtd on the host to deadlock or crash, resulting in a denial of service condition. (CVE-2021-4147)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

  - An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number     of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially     crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack     by causing the libvirt daemon to crash. (CVE-2024-1441)

  - A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory     for arrays before the non-negative length check is performed by the C API entry points. Passing a negative     length to the g_new0 function results in a crash due to the negative length being treated as a huge     positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by     causing the libvirt daemon to crash. (CVE-2024-2494)

  - A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This     issue can occur when detaching a host interface while at the same time collecting the list of interfaces     via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by     causing the libvirt daemon to crash. (CVE-2024-2496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5720 advisory.

    [5.7.0-15.el7]
    - qemu: Escape the qemu driver systemd DOT hoax (Wim ten Have)  [Orabug:
      31380815]

    [5.7.0-14.el7]
    - vmx: make 'fileName' optional for CD-ROMs (Pino Toscano)  [Orabug: 31350200]
    - vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk() (Pino Toscano)  [Orabug: 31350200]
    - domain group: Fix a potential SEGV while restoring guest domains (Wim ten Have)  [Orabug: 31285615]
    - cpu_map: Distinguish Cascadelake-Server from Skylake-Server (Jiri Denemark)  [Orabug: 31214897]
    - cpu_map: Add more -noTSX x86 CPU models (Christian Ehrhardt)  [Orabug: 31214897]
    - qemuDomainGetStatsIOThread: Don't leak array with 0 iothreads (Peter Krempa)  [Orabug: 31251756]     {CVE-2020-12430}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5719 advisory.

    [5.7.0-15.el7]
    - qemu: Escape the qemu driver systemd DOT hoax (Wim ten Have)  [Orabug:
      31380815]

    [5.7.0-14.el7]
    - vmx: make 'fileName' optional for CD-ROMs (Pino Toscano)  [Orabug: 31350200]
    - vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk() (Pino Toscano)  [Orabug: 31350200]
    - domain group: Fix a potential SEGV while restoring guest domains (Wim ten Have)  [Orabug: 31285615]
    - cpu_map: Distinguish Cascadelake-Server from Skylake-Server (Jiri Denemark)  [Orabug: 31214897]
    - cpu_map: Add more -noTSX x86 CPU models (Christian Ehrhardt)  [Orabug: 31214897]
    - qemuDomainGetStatsIOThread: Don't leak array with 0 iothreads (Peter Krempa)  [Orabug: 31251756]     {CVE-2020-12430}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A double free memory issue was found to occur in the     libvirt API, in versions before 6.8.0, responsible for     requesting information about network interfaces of a     running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting     to the read-write socket with limited ACL permissions     could use this flaw to crash the libvirt daemon,     resulting in a denial of service, or potentially     escalate their privileges on the system. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25637)

  - A flaw was found in libvirt, where it leaked a file     descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged     operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or     process to perform operations outside of their standard     permissions, potentially causing serious damage to the     host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-14339)

  - An issue was discovered in qemuDomainGetStatsIOThread     in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x     before 6.1.0. A memory leak was found in the     virDomainListGetStats libvirt API that is responsible     for retrieving domain statistics when managing QEMU     guests. This flaw allows unprivileged users with a     read-only connection to cause a memory leak in the     domstats command, resulting in a potential denial of     service.(CVE-2020-12430)

  - An information disclosure vulnerability was found in     libvirt. HTTP cookies used to access network-based     disks were saved in the XML dump of the guest domain.
    This flaw allows an attacker to access potentially     sensitive information in the domain configuration via     the `dumpxml` command.(CVE-2020-14301)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has libvirt packages installed that are affected by a vulnerability:

  - An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x     before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for     retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-     only connection to cause a memory leak in the domstats command, resulting in a potential denial of     service. (CVE-2020-12430)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Fix iptables No chain/target/match by that name (bz     #1813830)

  - systemd: start libvirtd after firewalld/iptables     services (bz #1697636)

  - CVE-2020-12430: memory leak in domstats may allow     read-only user to perform DoS attack (bz #1828216, bz     #1828190)

  - CVE-2020-10703: Potential denial of service via active     pool without target path (bz #1820690, bz #1816650)

  - CVE-2019-20485: potential DoS by holding a monitor job     while querying QEMU guest-agent (bz #1809741, bz     #1809740)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4371-1 advisory.

    It was discovered that libvirt incorrectly handled an active pool without a target path. A remote attacker     could possibly use this issue to cause libvirt to crash, resulting in a denial of service.
    (CVE-2020-10703)

    It was discovered that libvirt incorrectly handled memory when retrieving certain domain statistics. A     remote attacker could possibly use this issue to cause libvirt to consume resources, resulting in a denial     of service. This issue only affected Ubuntu 19.10. (CVE-2020-12430)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libvirt fixes the following issues :

Security issues fixed :

CVE-2020-10703: Fixed a daemon crash caused by pools without target paths (bsc#1168683).

CVE-2020-12430: Fixed a memory leak in qemuDomainGetStatsIOThread (bsc#1170765).

Non-security issues fixed :

Support setting credit2 scheduler parameters for xen (bsc#1162160).

Enable use of newer libxl APIs for retrieving memory statistics (bsc#1157490, bsc#1167007).

Create multipath targets for qemu PR (bsc#1161883).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issues fixed :

CVE-2020-10703: Fixed a daemon crash caused by pools without target paths (bsc#1168683).

CVE-2020-12430: Fixed a memory leak in qemuDomainGetStatsIOThread (bsc#1170765).

Non-security issues fixed :

Support setting credit2 scheduler parameters for xen (bsc#1162160).

Add SLE 15 and SLE 12 service packs support to 'libvirtd' (bsc#1154093).

Add support boot from 'vfio-ccw'and 'mdev' devices (jsc#SLE-5826, FATE#327355, bsc#1152649).

Fix lock manager lock ordering (bsc#1145774).

Do not define known no-op features. (bsc#1151850).

Enable use of newer libxl APIs for retrieving memory statistics (bsc#1157490, bsc#1167007).

Create multipath targets for qemu PR (bsc#1161883).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199016	RHEL 8 : 8.1_libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
192736	Debian dla-3778 : libnss-libvirt - security update	Nessus	Debian Local Security Checks	medium
180916	Oracle Linux 7 : libvirt (ELSA-2020-5720)	Nessus	Oracle Linux Local Security Checks	medium
180886	Oracle Linux 7 : libvirt (ELSA-2020-5719)	Nessus	Oracle Linux Local Security Checks	medium
147678	EulerOS Virtualization 2.9.0 : libvirt (EulerOS-SA-2021-1666)	Nessus	Huawei Local Security Checks	high
147481	EulerOS Virtualization 2.9.1 : libvirt (EulerOS-SA-2021-1631)	Nessus	Huawei Local Security Checks	high
147389	NewStart CGSL MAIN 6.02 : libvirt Vulnerability (NS-SA-2021-0050)	Nessus	NewStart CGSL Local Security Checks	medium
137425	Fedora 31 : libvirt (2020-5cd83efda7)	Nessus	Fedora Local Security Checks	medium
136802	Ubuntu 18.04 LTS : libvirt vulnerabilities (USN-4371-1)	Nessus	Ubuntu Local Security Checks	medium
136783	SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:1277-1)	Nessus	SuSE Local Security Checks	medium
136648	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:1208-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-12430

medium

Tenable Plugins

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium