A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt daemon.

The remote host is affected by the vulnerability described in GLSA-202412-16 (libvirt: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libvirt package has been released.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libvirt-9.5.0-5.el9 build changelog.

  - A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as     expected, resulting in a race condition and denial of service when attempting to lock the same object from     another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt     daemon. (CVE-2023-3750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2d35e47af3 advisory.

    Fix CVE-2023-3750 and CVE-2023-2700

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6409 advisory.

    - storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' (CVE-2023-3750,     rhbz#2221851)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6409 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    The following packages have been upgraded to a later upstream version: libvirt (9.5.0). (BZ#2175785)

    Security Fix(es):

    * libvirt: improper locking in virStoragePoolObjListSearch may lead to denial of service (CVE-2023-3750)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12855 advisory.

    - storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' (Peter Krempa) [Orabug:
    35644221] {CVE-2023-3750}
    - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (Tim Shearer) [Orabug: 35395469]     {CVE-2023-2700}
    - virtio-crypto: verify src&dst buffer length for sym request (zhenwei pi) [Orabug: 35683774]     {CVE-2023-3180}
    - io: remove io watch if TLS channel is closed during handshake (Daniel P. Berrange) [Orabug: 35683826]     {CVE-2023-3354}
    - ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) (Mauro Matteo Cascella) [Orabug:
    35683770] {CVE-2023-3255}
    - hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) (Thomas Huth) [Orabug:
    35683817] {CVE-2023-0330}
    - vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (Ani Sinha) [Orabug:
    35649138] {CVE-2023-3301}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3043-1 advisory.

  - A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as     expected, resulting in a race condition and denial of service when attempting to lock the same object from     another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt     daemon. (CVE-2023-3750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6253-1 advisory.

    It wad discovered that libvirt incorrectly handled locking when processing certain requests. A local     attacker could possibly use this issue to cause libvirt to stop responding or crash, resulting in a denial     of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
212331	GLSA-202412-16 : libvirt: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	medium
203587	Photon OS 5.0: Libvirt PHSA-2023-5.0-0057	Nessus	PhotonOS Local Security Checks	medium
191224	CentOS 9 : libvirt-9.5.0-5.el9	Nessus	CentOS Local Security Checks	medium
190390	Fedora 38 : libvirt (2024-2d35e47af3)	Nessus	Fedora Local Security Checks	medium
185877	Oracle Linux 9 : libvirt (ELSA-2023-6409)	Nessus	Oracle Linux Local Security Checks	medium
185152	RHEL 9 : libvirt (RHSA-2023:6409)	Nessus	Red Hat Local Security Checks	medium
182741	Oracle Linux 8 : kvm_utils3 (ELSA-2023-12855)	Nessus	Oracle Linux Local Security Checks	high
179119	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libvirt (SUSE-SU-2023:3043-1)	Nessus	SuSE Local Security Checks	medium
178915	Ubuntu 23.04 : libvirt vulnerability (USN-6253-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2023-3750

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium