ID CVE-2015-0236
Summary libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.
References
Vulnerable Configurations
  • cpe:2.3:o:mageia:mageia:4.0
    cpe:2.3:o:mageia:mageia:4.0
  • Red Hat libvirt 1.2.0
    cpe:2.3:a:redhat:libvirt:1.2.0
  • Red Hat libvirt 1.2.1
    cpe:2.3:a:redhat:libvirt:1.2.1
  • Red Hat libvirt 1.2.2
    cpe:2.3:a:redhat:libvirt:1.2.2
  • Red Hat libvirt 1.2.3
    cpe:2.3:a:redhat:libvirt:1.2.3
  • Red Hat libvirt 1.2.4
    cpe:2.3:a:redhat:libvirt:1.2.4
  • Red Hat libvirt 1.2.5
    cpe:2.3:a:redhat:libvirt:1.2.5
  • Red Hat libvirt 1.2.6
    cpe:2.3:a:redhat:libvirt:1.2.6
  • Red Hat libvirt 1.2.7
    cpe:2.3:a:redhat:libvirt:1.2.7
  • cpe:2.3:a:redhat:libvirt:1.2.8
    cpe:2.3:a:redhat:libvirt:1.2.8
  • cpe:2.3:a:redhat:libvirt:1.2.9
    cpe:2.3:a:redhat:libvirt:1.2.9
  • cpe:2.3:a:redhat:libvirt:1.2.10
    cpe:2.3:a:redhat:libvirt:1.2.10
  • cpe:2.3:a:redhat:libvirt:1.2.11
    cpe:2.3:a:redhat:libvirt:1.2.11
  • OpenSUSE 13.1
    cpe:2.3:o:opensuse:opensuse:13.1
  • OpenSUSE 13.2
    cpe:2.3:o:opensuse:opensuse:13.2
  • Canonical Ubuntu Linux 12.04 LTS
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:-:-:lts
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
  • Canonical Ubuntu Linux 15.04
    cpe:2.3:o:canonical:ubuntu_linux:15.04
  • Canonical Ubuntu Linux 15.10
    cpe:2.3:o:canonical:ubuntu_linux:15.10
  • RedHat Enterprise Linux Desktop 7.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
  • RedHat Enterprise Linux HPC Node 7.0
    cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • RedHat Enterprise Linux Workstation 7.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0
CVSS
Base: 3.5 (as of 30-08-2016 - 09:38)
Impact:
Exploitability:
CWE CWE-200
CAPEC
  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
  • Reusing Session IDs (aka Session Replay)
    This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
  • Using Slashes in Alternate Encoding
    This attack targets the encoding of the Slash characters. An attacker would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the attacker many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-0304-1.NASL
    description libvirt was updated to fix one security issue and several non-security issues. This security issue was fixed : - CVE-2015-0236: libvirt allowed remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. (bsc#914693) - CVE-2015-5313: path traversal vulnerability allowed libvirtd process to write arbitrary files into file system using root permissions (bsc#953110) Theses non-security issues were fixed : - bsc#948686: Use PAUSED state for domains that are starting up. - bsc#903757: Provide nodeGetSecurityModel implementation in libxl. - bsc#938228: Set disk type to BLOCK when driver is not tap or file. - bsc#948516: Fix profile_status to distinguish between errors and unconfined domains. - bsc#936524: Fix error starting lxc containers with direct interfaces. - bsc#921555: Fixed apparmor generated profile for PCI hostdevs. - bsc#899334: Include additional upstream fixes for systemd TerminateMachine. - bsc#921586: Fix security driver default settings in /etc/libvirt/qemu.conf. - bsc#921355: Fixed a number of QEMU apparmor abstraction problems. - bsc#911737: Additional fix for the case where security labels aren't automatically set. - bsc#914297: Allow setting the URL of an SMT server to use in place of SCC. - bsc#904432: Backported route definition changes. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 88560
    published 2016-02-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=88560
    title SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:0304-1)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2015-035.NASL
    description Updated libvirt packages fix security vulnerability : The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 81235
    published 2015-02-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81235
    title Mandriva Linux Security Advisory : libvirt (MDVSA-2015:035)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2015-112.NASL
    description This update fixes the following security issues : - CVE-2015-0236: libvirt: access control bypass bsc#914693 - bnc#905086: libvirt cannot properly determine cpu flags with qemu-kvm - Fixed allowing devices for containers.
    last seen 2019-02-21
    modified 2015-03-11
    plugin id 81238
    published 2015-02-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81238
    title openSUSE Security Update : libvirt (openSUSE-2015-112)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2015-1883.NASL
    description - Rebased to version 1.1.3.9 - CVE-2015-0236: missing ACL check for the VIR_DOMAIN_XML_SECURE flag in save images and snapshots objects (bz #1185769) - CVE-2014-8136: local denial of service in qemu/qemu_driver.c (bz #1176179) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 81392
    published 2015-02-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81392
    title Fedora 20 : libvirt-1.1.3.9-1.fc20 (2015-1883)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2867-1.NASL
    description It was discovered that libvirt incorrectly handled the firewall rules on bridge networks when the daemon was restarted. This could result in an unintended firewall configuration. This issue only applied to Ubuntu 12.04 LTS. (CVE-2011-4600) Peter Krempa discovered that libvirt incorrectly handled locking when certain ACL checks failed. A local attacker could use this issue to cause libvirt to stop responding, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS. (CVE-2014-8136) Luyao Huang discovered that libvirt incorrectly handled VNC passwords in shapshot and image files. A remote authenticated user could use this issue to possibly obtain VNC passwords. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-0236) Han Han discovered that libvirt incorrectly handled volume creation failure when used with NFS. A remote authenticated user could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only applied to Ubuntu 15.10. (CVE-2015-5247) Ossi Herrala and Joonas Kuorilehto discovered that libvirt incorrectly performed storage pool name validation. A remote authenticated user could use this issue to bypass ACLs and gain access to unintended files. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. (CVE-2015-5313). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 87888
    published 2016-01-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=87888
    title Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : libvirt vulnerabilities (USN-2867-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-0323.NASL
    description From Red Hat Security Advisory 2015:0323 : Updated libvirt packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. It was found that QEMU's qemuDomainMigratePerform() and qemuDomainMigrateFinish2() functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial of service. (CVE-2014-8136) It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. (CVE-2015-0236) The CVE-2015-0236 issue was found by Luyao Huang of Red Hat. Bug fixes : * The libvirtd daemon previously attempted to search for SELinux contexts even when SELinux was disabled on the host. Consequently, libvirtd logged 'Unable to lookup SELinux process context' error messages every time a client connected to libvirtd and SELinux was disabled. libvirtd now verifies whether SELinux is enabled before searching for SELinux contexts, and no longer logs the error messages on a host with SELinux disabled. (BZ#1135155) * The libvirt utility passed incomplete PCI addresses to QEMU. Consequently, assigning a PCI device that had a PCI address with a non-zero domain to a guest failed. Now, libvirt properly passes PCI domain to QEMU when assigning PCI devices, which prevents the described problem. (BZ#1127080) * Because the virDomainSetMaxMemory API did not allow changing the current memory in the LXC driver, the 'virsh setmaxmem' command failed when attempting to set the maximum memory to be lower than the current memory. Now, 'virsh setmaxmem' sets the current memory to the intended value of the maximum memory, which avoids the mentioned problem. (BZ#1091132) * Attempting to start a non-existent domain caused network filters to stay locked for read-only access. Because of this, subsequent attempts to gain read-write access to network filters triggered a deadlock. Network filters are now properly unlocked in the described scenario, and the deadlock no longer occurs. (BZ#1088864) * If a guest configuration had an active nwfilter using the DHCP snooping feature and an attempt was made to terminate libvirtd before the associated nwfilter rule snooped the guest IP address from DHCP packets, libvirtd became unresponsive. This problem has been fixed by setting a longer wait time for snooping the guest IP address. (BZ#1075543) Enhancements : * A new 'migrate_host' option is now available in /etc/libvirt/qemu.conf, which allows users to set a custom IP address to be used for incoming migrations. (BZ#1087671) * With this update, libvirt is able to create a compressed memory-only crash dump of a QEMU domain. This type of crash dump is directly readable by the GNU Debugger and requires significantly less hard disk space than the standard crash dump. (BZ#1035158) * Support for reporting the NUMA node distance of the host has been added to libvirt. This enhances the current libvirt capabilities for reporting NUMA topology of the host, and allows for easier optimization of new domains. (BZ#1086331) * The XML file of guest and host capabilities generated by the 'virsh capabilities' command has been enhanced to list the following information, where relevant: the interface speed and link status of the host, the PCI Express (PCIe) details, the host's hardware support for I/O virtualization, and a report on the huge memory pages. (BZ#1076960, BZ#1076957, BZ#1076959, BZ#1076962) These packages also include a number of other bug fixes and enhancements. For additional details, see the 'Bugs Fixed' section below.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 81801
    published 2015-03-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81801
    title Oracle Linux 7 : libvirt (ELSA-2015-0323)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2015-1892.NASL
    description - Rebased to version 1.2.9.2 - CVE-2014-8131: deadlock and segfault in qemuConnectGetAllDomainStats (bz #1172571) - CVE-2015-0236: missing ACL check for the VIR_DOMAIN_XML_SECURE flag in save images and snapshots objects (bz #1185769) - CVE-2014-8136: local denial of service in qemu/qemu_driver.c (bz #1176179) - Fix crash parsing nbd URIs (bz #1188644) - Fix domain startup failing with 'strict' mode in numatune (bz #1168672) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 81365
    published 2015-02-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81365
    title Fedora 21 : libvirt-1.2.9.2-1.fc21 (2015-1892)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-0323.NASL
    description Updated libvirt packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. It was found that QEMU's qemuDomainMigratePerform() and qemuDomainMigrateFinish2() functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial of service. (CVE-2014-8136) It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. (CVE-2015-0236) The CVE-2015-0236 issue was found by Luyao Huang of Red Hat. Bug fixes : * The libvirtd daemon previously attempted to search for SELinux contexts even when SELinux was disabled on the host. Consequently, libvirtd logged 'Unable to lookup SELinux process context' error messages every time a client connected to libvirtd and SELinux was disabled. libvirtd now verifies whether SELinux is enabled before searching for SELinux contexts, and no longer logs the error messages on a host with SELinux disabled. (BZ#1135155) * The libvirt utility passed incomplete PCI addresses to QEMU. Consequently, assigning a PCI device that had a PCI address with a non-zero domain to a guest failed. Now, libvirt properly passes PCI domain to QEMU when assigning PCI devices, which prevents the described problem. (BZ#1127080) * Because the virDomainSetMaxMemory API did not allow changing the current memory in the LXC driver, the 'virsh setmaxmem' command failed when attempting to set the maximum memory to be lower than the current memory. Now, 'virsh setmaxmem' sets the current memory to the intended value of the maximum memory, which avoids the mentioned problem. (BZ#1091132) * Attempting to start a non-existent domain caused network filters to stay locked for read-only access. Because of this, subsequent attempts to gain read-write access to network filters triggered a deadlock. Network filters are now properly unlocked in the described scenario, and the deadlock no longer occurs. (BZ#1088864) * If a guest configuration had an active nwfilter using the DHCP snooping feature and an attempt was made to terminate libvirtd before the associated nwfilter rule snooped the guest IP address from DHCP packets, libvirtd became unresponsive. This problem has been fixed by setting a longer wait time for snooping the guest IP address. (BZ#1075543) Enhancements : * A new 'migrate_host' option is now available in /etc/libvirt/qemu.conf, which allows users to set a custom IP address to be used for incoming migrations. (BZ#1087671) * With this update, libvirt is able to create a compressed memory-only crash dump of a QEMU domain. This type of crash dump is directly readable by the GNU Debugger and requires significantly less hard disk space than the standard crash dump. (BZ#1035158) * Support for reporting the NUMA node distance of the host has been added to libvirt. This enhances the current libvirt capabilities for reporting NUMA topology of the host, and allows for easier optimization of new domains. (BZ#1086331) * The XML file of guest and host capabilities generated by the 'virsh capabilities' command has been enhanced to list the following information, where relevant: the interface speed and link status of the host, the PCI Express (PCIe) details, the host's hardware support for I/O virtualization, and a report on the huge memory pages. (BZ#1076960, BZ#1076957, BZ#1076959, BZ#1076962) These packages also include a number of other bug fixes and enhancements. For additional details, see the 'Bugs Fixed' section below.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81887
    published 2015-03-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81887
    title CentOS 7 : libvirt (CESA-2015:0323)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20150305_LIBVIRT_ON_SL7_X.NASL
    description It was found that QEMU's qemuDomainMigratePerform() and qemuDomainMigrateFinish2() functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial of service. (CVE-2014-8136) It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. (CVE-2015-0236) Bug fixes : - The libvirtd daemon previously attempted to search for SELinux contexts even when SELinux was disabled on the host. Consequently, libvirtd logged 'Unable to lookup SELinux process context' error messages every time a client connected to libvirtd and SELinux was disabled. libvirtd now verifies whether SELinux is enabled before searching for SELinux contexts, and no longer logs the error messages on a host with SELinux disabled. - The libvirt utility passed incomplete PCI addresses to QEMU. Consequently, assigning a PCI device that had a PCI address with a non- zero domain to a guest failed. Now, libvirt properly passes PCI domain to QEMU when assigning PCI devices, which prevents the described problem. - Because the virDomainSetMaxMemory API did not allow changing the current memory in the LXC driver, the 'virsh setmaxmem' command failed when attempting to set the maximum memory to be lower than the current memory. Now, 'virsh setmaxmem' sets the current memory to the intended value of the maximum memory, which avoids the mentioned problem. - Attempting to start a non-existent domain caused network filters to stay locked for read-only access. Because of this, subsequent attempts to gain read-write access to network filters triggered a deadlock. Network filters are now properly unlocked in the described scenario, and the deadlock no longer occurs. - If a guest configuration had an active nwfilter using the DHCP snooping feature and an attempt was made to terminate libvirtd before the associated nwfilter rule snooped the guest IP address from DHCP packets, libvirtd became unresponsive. This problem has been fixed by setting a longer wait time for snooping the guest IP address. Enhancements : - A new 'migrate_host' option is now available in /etc/libvirt/qemu.conf, which allows users to set a custom IP address to be used for incoming migrations. - With this update, libvirt is able to create a compressed memory-only crash dump of a QEMU domain. This type of crash dump is directly readable by the GNU Debugger and requires significantly less hard disk space than the standard crash dump. - Support for reporting the NUMA node distance of the host has been added to libvirt. This enhances the current libvirt capabilities for reporting NUMA topology of the host, and allows for easier optimization of new domains. - The XML file of guest and host capabilities generated by the 'virsh capabilities' command has been enhanced to list the following information, where relevant: the interface speed and link status of the host, the PCI Express (PCIe) details, the host's hardware support for I/O virtualization, and a report on the huge memory pages. These packages also include a number of other bug fixes and enhancements.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 82257
    published 2015-03-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82257
    title Scientific Linux Security Update : libvirt on SL7.x x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-0323.NASL
    description Updated libvirt packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. It was found that QEMU's qemuDomainMigratePerform() and qemuDomainMigrateFinish2() functions did not correctly perform a domain unlock on a failed ACL check. A remote attacker able to establish a connection to libvirtd could use this flaw to lock a domain of a more privileged user, causing a denial of service. (CVE-2014-8136) It was discovered that the virDomainSnapshotGetXMLDesc() and virDomainSaveImageGetXMLDesc() functions did not sufficiently limit the usage of the VIR_DOMAIN_XML_SECURE flag when fine-grained ACLs were enabled. A remote attacker able to establish a connection to libvirtd could use this flaw to obtain certain sensitive information from the domain XML file. (CVE-2015-0236) The CVE-2015-0236 issue was found by Luyao Huang of Red Hat. Bug fixes : * The libvirtd daemon previously attempted to search for SELinux contexts even when SELinux was disabled on the host. Consequently, libvirtd logged 'Unable to lookup SELinux process context' error messages every time a client connected to libvirtd and SELinux was disabled. libvirtd now verifies whether SELinux is enabled before searching for SELinux contexts, and no longer logs the error messages on a host with SELinux disabled. (BZ#1135155) * The libvirt utility passed incomplete PCI addresses to QEMU. Consequently, assigning a PCI device that had a PCI address with a non-zero domain to a guest failed. Now, libvirt properly passes PCI domain to QEMU when assigning PCI devices, which prevents the described problem. (BZ#1127080) * Because the virDomainSetMaxMemory API did not allow changing the current memory in the LXC driver, the 'virsh setmaxmem' command failed when attempting to set the maximum memory to be lower than the current memory. Now, 'virsh setmaxmem' sets the current memory to the intended value of the maximum memory, which avoids the mentioned problem. (BZ#1091132) * Attempting to start a non-existent domain caused network filters to stay locked for read-only access. Because of this, subsequent attempts to gain read-write access to network filters triggered a deadlock. Network filters are now properly unlocked in the described scenario, and the deadlock no longer occurs. (BZ#1088864) * If a guest configuration had an active nwfilter using the DHCP snooping feature and an attempt was made to terminate libvirtd before the associated nwfilter rule snooped the guest IP address from DHCP packets, libvirtd became unresponsive. This problem has been fixed by setting a longer wait time for snooping the guest IP address. (BZ#1075543) Enhancements : * A new 'migrate_host' option is now available in /etc/libvirt/qemu.conf, which allows users to set a custom IP address to be used for incoming migrations. (BZ#1087671) * With this update, libvirt is able to create a compressed memory-only crash dump of a QEMU domain. This type of crash dump is directly readable by the GNU Debugger and requires significantly less hard disk space than the standard crash dump. (BZ#1035158) * Support for reporting the NUMA node distance of the host has been added to libvirt. This enhances the current libvirt capabilities for reporting NUMA topology of the host, and allows for easier optimization of new domains. (BZ#1086331) * The XML file of guest and host capabilities generated by the 'virsh capabilities' command has been enhanced to list the following information, where relevant: the interface speed and link status of the host, the PCI Express (PCIe) details, the host's hardware support for I/O virtualization, and a report on the huge memory pages. (BZ#1076960, BZ#1076957, BZ#1076959, BZ#1076962) These packages also include a number of other bug fixes and enhancements. For additional details, see the 'Bugs Fixed' section below.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 81628
    published 2015-03-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81628
    title RHEL 7 : libvirt (RHSA-2015:0323)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2015-070.NASL
    description Updated libvirt packages fixes security vulnerabilities : The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136). The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236). The updated packages provides the latest 1.1.3.9 version whish has more robust fixes for MDVSA-2015:023 and MDVSA-2015:035.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 82323
    published 2015-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82323
    title Mandriva Linux Security Advisory : libvirt (MDVSA-2015:070)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2015-115.NASL
    description Updated libvirt packages fix security vulnerabilities : The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456). libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179). An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process (CVE-2014-3633). A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive (CVE-2014-3657). Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file (CVE-2014-7823). The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136). The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 82368
    published 2015-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82368
    title Mandriva Linux Security Advisory : libvirt (MDVSA-2015:115)
redhat via4
advisories
bugzilla
id 1184431
title CVE-2015-0236 libvirt: missing ACL check for the VIR_DOMAIN_XML_SECURE flag in save images and snapshots objects
oval
AND
  • OR
    • comment Red Hat Enterprise Linux 7 Client is installed
      oval oval:com.redhat.rhsa:tst:20140675001
    • comment Red Hat Enterprise Linux 7 Server is installed
      oval oval:com.redhat.rhsa:tst:20140675002
    • comment Red Hat Enterprise Linux 7 Workstation is installed
      oval oval:com.redhat.rhsa:tst:20140675003
    • comment Red Hat Enterprise Linux 7 ComputeNode is installed
      oval oval:com.redhat.rhsa:tst:20140675004
  • OR
    • AND
      • comment libvirt is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323005
      • comment libvirt is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20110391006
    • AND
      • comment libvirt-client is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323015
      • comment libvirt-client is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20110391010
    • AND
      • comment libvirt-daemon is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323013
      • comment libvirt-daemon is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914016
    • AND
      • comment libvirt-daemon-config-network is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323017
      • comment libvirt-daemon-config-network is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914008
    • AND
      • comment libvirt-daemon-config-nwfilter is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323019
      • comment libvirt-daemon-config-nwfilter is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914022
    • AND
      • comment libvirt-daemon-driver-interface is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323027
      • comment libvirt-daemon-driver-interface is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914028
    • AND
      • comment libvirt-daemon-driver-lxc is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323011
      • comment libvirt-daemon-driver-lxc is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914026
    • AND
      • comment libvirt-daemon-driver-network is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323023
      • comment libvirt-daemon-driver-network is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914010
    • AND
      • comment libvirt-daemon-driver-nodedev is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323007
      • comment libvirt-daemon-driver-nodedev is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914020
    • AND
      • comment libvirt-daemon-driver-nwfilter is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323025
      • comment libvirt-daemon-driver-nwfilter is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914038
    • AND
      • comment libvirt-daemon-driver-qemu is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323041
      • comment libvirt-daemon-driver-qemu is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914040
    • AND
      • comment libvirt-daemon-driver-secret is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323029
      • comment libvirt-daemon-driver-secret is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914012
    • AND
      • comment libvirt-daemon-driver-storage is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323021
      • comment libvirt-daemon-driver-storage is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914018
    • AND
      • comment libvirt-daemon-kvm is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323037
      • comment libvirt-daemon-kvm is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914044
    • AND
      • comment libvirt-daemon-lxc is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323009
      • comment libvirt-daemon-lxc is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914030
    • AND
      • comment libvirt-devel is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323031
      • comment libvirt-devel is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20110391008
    • AND
      • comment libvirt-docs is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323033
      • comment libvirt-docs is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914032
    • AND
      • comment libvirt-lock-sanlock is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323039
      • comment libvirt-lock-sanlock is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20120748014
    • AND
      • comment libvirt-login-shell is earlier than 0:1.2.8-16.el7
        oval oval:com.redhat.rhsa:tst:20150323035
      • comment libvirt-login-shell is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20140914014
rhsa
id RHSA-2015:0323
released 2015-03-05
severity Low
title RHSA-2015:0323: libvirt security, bug fix, and enhancement update (Low)
rpms
  • libvirt-0:1.2.8-16.el7
  • libvirt-client-0:1.2.8-16.el7
  • libvirt-daemon-0:1.2.8-16.el7
  • libvirt-daemon-config-network-0:1.2.8-16.el7
  • libvirt-daemon-config-nwfilter-0:1.2.8-16.el7
  • libvirt-daemon-driver-interface-0:1.2.8-16.el7
  • libvirt-daemon-driver-lxc-0:1.2.8-16.el7
  • libvirt-daemon-driver-network-0:1.2.8-16.el7
  • libvirt-daemon-driver-nodedev-0:1.2.8-16.el7
  • libvirt-daemon-driver-nwfilter-0:1.2.8-16.el7
  • libvirt-daemon-driver-qemu-0:1.2.8-16.el7
  • libvirt-daemon-driver-secret-0:1.2.8-16.el7
  • libvirt-daemon-driver-storage-0:1.2.8-16.el7
  • libvirt-daemon-kvm-0:1.2.8-16.el7
  • libvirt-daemon-lxc-0:1.2.8-16.el7
  • libvirt-devel-0:1.2.8-16.el7
  • libvirt-docs-0:1.2.8-16.el7
  • libvirt-lock-sanlock-0:1.2.8-16.el7
  • libvirt-login-shell-0:1.2.8-16.el7
refmap via4
confirm
mandriva
  • MDVSA-2015:035
  • MDVSA-2015:070
secunia 62766
suse openSUSE-SU-2015:0225
ubuntu USN-2867-1
Last major update 30-08-2016 - 10:13
Published 29-01-2015 - 10:59
Last modified 30-10-2018 - 12:27
Back to Top