Mandriva Linux Security Advisory : libvirt (MDVSA-2015:115)

medium Nessus Plugin ID 82368

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Updated libvirt packages fix security vulnerabilities :

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456).

libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179).

An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process (CVE-2014-3633).

A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive (CVE-2014-3657).

Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file (CVE-2014-7823).

The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136).

The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

Solution

Update the affected lib64virt-devel, lib64virt0 and / or libvirt-utils packages.

Plugin Details

Severity: Medium

ID: 82368

File Name: mandriva_MDVSA-2015-115.nasl

Version: 1.4

Type: local

Family: Mandriva Local Security Checks

Published: 3/30/2015

Updated: 1/14/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Vector: CVSS2#AV:A/AC:M/Au:S/C:N/I:P/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:libvirt-utils, p-cpe:/a:mandriva:linux:lib64virt-devel, cpe:/o:mandriva:business_server:2, p-cpe:/a:mandriva:linux:lib64virt0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 3/29/2015

Reference Information

CVE: CVE-2013-6456, CVE-2014-0179, CVE-2014-3633, CVE-2014-3657, CVE-2014-7823, CVE-2014-8136, CVE-2015-0236

MDVSA: 2015:115

Detections

Analytics