A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.

An update of the libvirt package has been released.

The version of libvirt installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-2700 advisory.

  - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI     device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction     array within the parent struct's g_autoptr cleanup. (CVE-2023-2700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12435 advisory.

    - Document CVEs as fixed (Karl Heubaum) {CVE-2023-2700}
    - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364474]     {CVE-2024-1441}
    - Document CVEs as fixed (Mark Kanda) [Orabug: 36455470] [Orabug: 36455480] [Orabug: 36455529] [Orabug:
    36455489] [Orabug: 36455500] [Orabug: 36455512] [Orabug: 36455520] {CVE-2023-4135} {CVE-2023-3255}     {CVE-2023-6683} {CVE-2023-40360} {CVE-2023-42467} {CVE-2024-26327} {CVE-2024-24474}
    - hw/pvrdma: Protect against buggy or malicious guest driver (Yuval Shaia) [Orabug: 35250119]     {CVE-2023-1544}
    - net: Update MemReentrancyGuard for NIC (Akihiko Odaki) [Orabug: 36421467] {CVE-2023-3019}
    - net: Provide MemReentrancyGuard * to qemu_new_nic() (Akihiko Odaki) [Orabug: 36421467] {CVE-2023-3019}
    - lsi53c895a: disable reentrancy detection for MMIO region, too (Thomas Huth) [Orabug: 36425307]     {CVE-2021-3750}
    - memory: stricter checks prior to unsetting engaged_in_io (Alexander Bulekov) [Orabug: 36425307]     {CVE-2021-3750}
    - async: avoid use-after-free on re-entrancy guard (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
    - apic: disable reentrancy detection for apic-msi (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
    - raven: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
    - bcm2835_property: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 36425307]     {CVE-2021-3750}
    - lsi53c895a: disable reentrancy detection for script RAM (Alexander Bulekov) [Orabug: 36425307]     {CVE-2021-3750}
    - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (Alexander Bulekov) [Orabug: 36425307]     {CVE-2021-3750}
    - checkpatch: add qemu_bh_new/aio_bh_new checks (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
    - async: Add an optional reentrancy guard to the BH API (Alexander Bulekov) [Orabug: 36425307]     {CVE-2021-3750}
    - memory: prevent dma-reentracy issues (Alexander Bulekov) [Orabug: 36425307] {CVE-2021-3750}
    - util/async: add a human-readable name to BHs for debugging (Stefan Hajnoczi) [Orabug: 36425307]     {CVE-2021-3750}
    - io: remove io watch if TLS channel is closed during handshake (Daniel Berrange) [Orabug: 35595204]     {CVE-2023-3354}
    - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fiona Ebner) [Orabug:
    36327659] {CVE-2023-5088}
    - hw/ide: reset: cancel async DMA operation before resetting state (Fiona Ebner) [Orabug: 36327659]     {CVE-2023-5088}
    - accel/tcg: fix race in cpu_exec_step_atomic (bug 1863025) (Alex Bennee) [Orabug: 36327651]     {CVE-2020-24165}
    - virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35724113]     {CVE-2023-3180}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libvirt: Insecure sVirt label generation (CVE-2021-3631)

  - An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in     the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly     released on ACL permission failure. Clients connecting to the read-write socket with limited ACL     permissions could use this flaw to acquire the lock and prevent other users from accessing storage     pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability     is to system availability. (CVE-2021-3667)

  - A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in     qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a     monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is     shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial     of service attack by causing the libvirt daemon to crash. (CVE-2021-3975)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2d35e47af3 advisory.

    Fix CVE-2023-3750 and CVE-2023-2700

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:3822 advisory.

  - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI     device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction     array within the parent struct's g_autoptr cleanup. (CVE-2023-2700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12924 advisory.

    - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (Tim Shearer) [Orabug: 35395469]     {CVE-2023-2700}

    libvirt-dbus     libvirt-python

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12855 advisory.

    - storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' (Peter Krempa) [Orabug:
    35644221] {CVE-2023-3750}
    - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (Tim Shearer) [Orabug: 35395469]     {CVE-2023-2700}
    - virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35683774]     {CVE-2023-3180}
    - io: remove io watch if TLS channel is closed during handshake (Daniel P. Berrange) [Orabug: 35683826]     {CVE-2023-3354}
    - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) (Mauro Matteo Cascella) [Orabug:
    35683770] {CVE-2023-3255}
    - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug:
    35683817] {CVE-2023-0330}
    - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha) [Orabug:
    35649138] {CVE-2023-3301}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:3715 advisory.

  - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI     device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction     array within the parent struct's g_autoptr cleanup. (CVE-2023-2700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4799 advisory.

    Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and     other OSes).

    Security Fix(es):

    * libvirt: Memory leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * No bootable device with OS boot disk interface VirtIO-SCSI and with more than 9 VirtIO disks.
    (BZ#2228486)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3822 advisory.

    - Fix CVE-2022-2211 Denial of Service in --key parameter       resolves: rhbz#2101280
    - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,       CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789       resolves: rhbz#2127240 rhbz#2127248       (also: 2127233 2127234 2127241 2127249 2127255 2127256 2127262 2127263)

    libiscsi     libnbd
    - Fix CVE-2022-0485: Fail nbdcopy if NBD read or write fails       resolves: rhbz#2045718
    - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
    - Backport 'tpm2: Check size of buffer before accessing it' (CVE-2023-1017 & CVE-2023-1018)       Resolves: rhbz#2173964       Resolves: rhbz#2173970

    libvirt
    - virpci: Resolve leak in virPCIVirtualFunctionList cleanup [CVE-2023-2700]
    - node_device_conf: Avoid memleak in virNodeDeviceGetPCIVPDDynamicCap() [CVE-2023-2700]
    - nwfilter: fix crash when counting number of network filters (CVE-2022-0897, rhbz#2063902)
    - security: fix SELinux label generation logic (CVE-2021-3631)
    - storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath (CVE-2021-3667)
    - rpc: gendispatch: handle empty flags (CVE-2020-25637)
    - rpc: add support for filtering @acls by uint params (CVE-2020-25637)
    - rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
    - qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
    - virdevmapper: Don't use libdevmapper to obtain dependencies (CVE-2020-14339, rhbz#1860421)
    - conf: Don't format http cookies unless VIR_DOMAIN_DEF_FORMAT_SECURE is used (CVE-2020-14301)
    - cpu_map: Add TAA_NO bit for IA32_ARCH_CAPABILITIES MSR (CVE-2019-11135)
    - cpu_map: Add TSX_CTRL bit for IA32_ARCH_CAPABILITIES MSR (CVE-2019-11135)
    - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161)
    - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166)
    - api: disallow virConnectGetDomainCapabilities on read-only connections (CVE-2019-10167)
    - api: disallow virConnect*HypervisorCPU on read-only connections (CVE-2019-10168)
    - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
    - locking: restrict sockets to mode 0600 (CVE-2019-10132)
    - logging: restrict sockets to mode 0600 (CVE-2019-10132)
    - cpu_x86: Do not cache microcode version (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
    - qemu: Don't cache microcode version (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
    - cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126,     CVE-2018-12130)
    - cpu_map: Define md-clear CPUID bit (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
    - Resolves: bz#2148545       (CVE-2022-4144 virt:rhel/qemu-kvm: QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-     of-bounds read [rhel-8])
    - Resolves: bz#2129760       (CVE-2022-3165 virt:rhel/qemu-kvm: QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU     exhaustion [rhel-8])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:3822 advisory.

  - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI     device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction     array within the parent struct's g_autoptr cleanup. (CVE-2023-2700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2652-1 advisory.

  - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI     device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction     array within the parent struct's g_autoptr cleanup. (CVE-2023-2700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3822 advisory.

  - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI     device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction     array within the parent struct's g_autoptr cleanup. (CVE-2023-2700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3822 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libvirt: Memory leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Logs are spammed with ' Domain id=7 is tainted: custom-ga-command' message (BZ#2180030)

    * [qemu] snapshot is failing with error libvirt.libvirtError: internal error: QEMU monitor reply exceeds     buffer size (10485760 bytes) (BZ#2181575)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:3715 advisory.

  - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI     device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction     array within the parent struct's g_autoptr cleanup. (CVE-2023-2700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3715 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: Memory leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3715 advisory.

    [9.0.0-10.2.0.1]
    - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554]

    [9.0.0-10.2.el9_2]
    - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700, rhbz#2208596)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2356-1 advisory.

  - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI     device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction     array within the parent struct's g_autoptr cleanup. (CVE-2023-2700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6126-1 advisory.

    It was discovered that libvirt incorrectly handled the nwfilter driver. A local attacker could possibly     use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected     Ubuntu 22.04 LTS. (CVE-2022-0897)

    It was discovered that libvirt incorrectly handled queries for the SR-IOV PCI device capabilities. A local     attacker could possibly use this issue to cause libvirt to consume resources, leading to a denial of     service. (CVE-2023-2700)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	high
206823	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.100173)	Nessus	Misc.	high
204449	Photon OS 4.0: Libvirt PHSA-2023-4.0-0397	Nessus	PhotonOS Local Security Checks	medium
204177	Photon OS 5.0: Libvirt PHSA-2023-5.0-0023	Nessus	PhotonOS Local Security Checks	medium
201704	CBL Mariner 2.0 Security Update: libvirt (CVE-2023-2700)	Nessus	MarinerOS Local Security Checks	medium
200518	Oracle Linux 8 : virt:kvm_utils1 (ELSA-2024-12435)	Nessus	Oracle Linux Local Security Checks	medium
199179	RHEL 8 : libvirt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
190390	Fedora 38 : libvirt (2024-2d35e47af3)	Nessus	Fedora Local Security Checks	medium
184521	Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2023:3822)	Nessus	Rocky Linux Local Security Checks	medium
183432	Oracle Linux 8 : kvm_utils2 (ELSA-2023-12924)	Nessus	Oracle Linux Local Security Checks	medium
182741	Oracle Linux 8 : kvm_utils3 (ELSA-2023-12855)	Nessus	Oracle Linux Local Security Checks	high
180396	Rocky Linux 9 : libvirt (RLSA-2023:3715)	Nessus	Rocky Linux Local Security Checks	medium
180242	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:4799)	Nessus	Red Hat Local Security Checks	medium
178266	Oracle Linux 8 : virt:ol / and / virt-devel:rhel (ELSA-2023-3822)	Nessus	Oracle Linux Local Security Checks	medium
177772	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2023:3822)	Nessus	Alma Linux Local Security Checks	medium
177693	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libvirt (SUSE-SU-2023:2652-1)	Nessus	SuSE Local Security Checks	medium
177667	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2023:3822)	Nessus	CentOS Local Security Checks	medium
177666	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:3822)	Nessus	Red Hat Local Security Checks	medium
177630	AlmaLinux 9 : libvirt (ALSA-2023:3715)	Nessus	Alma Linux Local Security Checks	medium
177531	RHEL 9 : libvirt (RHSA-2023:3715)	Nessus	Red Hat Local Security Checks	medium
177498	Oracle Linux 9 : libvirt (ELSA-2023-3715)	Nessus	Oracle Linux Local Security Checks	medium
176648	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libvirt (SUSE-SU-2023:2356-1)	Nessus	SuSE Local Security Checks	medium
176534	Ubuntu 22.04 LTS / 23.04 : libvirt vulnerabilities (USN-6126-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2023-2700

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium