A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4676 advisory.

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage). (CVE-2019-20485)

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

  - An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used     to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker     to access potentially sensitive information in the domain configuration via the `dumpxml` command.
    (CVE-2020-14301)

  - A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-14339)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4676 advisory.

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage). (CVE-2019-20485)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

  - An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used     to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker     to access potentially sensitive information in the domain configuration via the `dumpxml` command.
    (CVE-2020-14301)

  - A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-14339)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202210-06 (libvirt: Multiple Vulnerabilities)

  - A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-14339)

  - A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible     for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting to the read-write socket with limited ACL     permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or     potentially escalate their privileges on the system. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25637)

  - A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This     flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out     of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
    (CVE-2021-3631)

  - An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in     the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly     released on ACL permission failure. Clients connecting to the read-write socket with limited ACL     permissions could use this flaw to acquire the lock and prevent other users from accessing storage     pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability     is to system availability. (CVE-2021-3667)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4676 advisory.

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage). (CVE-2019-20485)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

  - An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used     to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker     to access potentially sensitive information in the domain configuration via the `dumpxml` command.
    (CVE-2020-14301)

  - A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-14339)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A double free memory issue was found to occur in the     libvirt API, in versions before 6.8.0, responsible for     requesting information about network interfaces of a     running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting     to the read-write socket with limited ACL permissions     could use this flaw to crash the libvirt daemon,     resulting in a denial of service, or potentially     escalate their privileges on the system. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25637)

  - A flaw was found in libvirt, where it leaked a file     descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged     operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or     process to perform operations outside of their standard     permissions, potentially causing serious damage to the     host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-14339)

  - An issue was discovered in qemuDomainGetStatsIOThread     in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x     before 6.1.0. A memory leak was found in the     virDomainListGetStats libvirt API that is responsible     for retrieving domain statistics when managing QEMU     guests. This flaw allows unprivileged users with a     read-only connection to cause a memory leak in the     domstats command, resulting in a potential denial of     service.(CVE-2020-12430)

  - An information disclosure vulnerability was found in     libvirt. HTTP cookies used to access network-based     disks were saved in the XML dump of the guest domain.
    This flaw allows an attacker to access potentially     sensitive information in the domain configuration via     the `dumpxml` command.(CVE-2020-14301)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4676 advisory.

  - QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

  - libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

  - libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

  - libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

  - libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

  - QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-22 (libvirt: Unintended access to /dev/mapper/control)

    A file descriptor for /dev/mapper/control was insufficiently protected.
  Impact :

    A local attacker may be able to escalate to root privileges.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4676 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    The following packages have been upgraded to a later upstream version: hivex (1.3.18), libguestfs     (1.40.2), libguestfs-winsupport (8.2), libvirt (6.0.0), libvirt-dbus (1.3.0), libvirt-python (6.0.0),     nbdkit (1.16.2), perl-Sys-Virt (6.0.0), qemu-kvm (4.2.0), seabios (1.13.0), SLOF (20191022). (BZ#1810193,     BZ#1844296)

    Security Fix(es):

    * libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

    * QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

    * libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

    * QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

    * libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

    * libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libvirt fixes the following issues :

  - CVE-2020-14339: Don't leak /dev/mapper/control into     QEMU. Use ioctl's to obtain the dependency tree of disks     and drop use of libdevmapper. bsc#1161883, bsc#1174458

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3586 advisory.

    The Advanced Virtualization module provides the user-space component for running virtual machines that use     KVM in environments managed by Red Hat products.

    Security Fix(es):

    * libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

    * QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * QEMU command 'transaction': Bitmap already exists: libvirt-tmp-activewrite  (BZ#1861681)

    * qemu-img convert uses possibly slow pre-zeroing on block storage (BZ#1861682)

    * from time to time virsh net-dhcp-leases <net> does not show all leases (BZ#1868271)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libvirt fixes the following issues :

CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper.
bsc#1161883, bsc#1174458

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc#1161883, bsc#1174458

qemu: Setup emulator thread and cpuset.mems before exec - bsc#1171946

libxl: Normalize MAC address in device conf on netdev hotplug - bsc#1172052

spec: Use a functional requires instead of explicit version requires for the new memory-related libxl APIs - bsc#1167007

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc#1161883, bsc#1174458

qemu: Setup emulator thread and cpuset.mems before exec - bsc#1171946

libxl: Normalize MAC address in device conf on netdev hotplug - bsc#1172052

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184870	Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2020:4676)	Nessus	Rocky Linux Local Security Checks	high
180926	Oracle Linux 8 : virt:ol / and / virt-devel:rhel (ELSA-2020-4676)	Nessus	Oracle Linux Local Security Checks	high
166166	GLSA-202210-06 : libvirt: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
157535	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2020:4676)	Nessus	Alma Linux Local Security Checks	high
147678	EulerOS Virtualization 2.9.0 : libvirt (EulerOS-SA-2021-1666)	Nessus	Huawei Local Security Checks	high
147481	EulerOS Virtualization 2.9.1 : libvirt (EulerOS-SA-2021-1631)	Nessus	Huawei Local Security Checks	high
146032	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2020:4676)	Nessus	CentOS Local Security Checks	high
145425	GLSA-202101-22 : libvirt: Unintended access to /dev/mapper/control	Nessus	Gentoo Local Security Checks	high
142449	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2020:4676)	Nessus	Red Hat Local Security Checks	high
140685	openSUSE Security Update : libvirt (openSUSE-2020-1455)	Nessus	SuSE Local Security Checks	high
140110	RHEL 8 : virt:8.2 and virt-devel:8.2 (RHSA-2020:3586)	Nessus	Red Hat Local Security Checks	high
139690	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:2269-1)	Nessus	SuSE Local Security Checks	high
139656	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:2237-1)	Nessus	SuSE Local Security Checks	high
139594	SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:2233-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-14339

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high