libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Collective May/2011 update for Xen

Xen :

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related.

  - 679344 - Xen: multi-vCPU pv guest may crash host

  - 681044 - update xenpaging.autostart.patch

  - 681302 - xm create -x <guest> returns 'ImportError: No     module named ext'

  - 688473 - potential buffer overflow in tools

  - 691738 - Xen does not find device create with npiv block

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

  - 631680 - OpenSUSE 11.3 KVM install of windows xp fails     on first reboot during installation.

several API calls did not honor the read-only flag connections.
Attackers could exploit that to modify the state of the system or potentially execute code (CVE-2011-1146).

Collective May/2011 update for Xen

Xen :

  - 691238 - L3: question on behaviour change xm list

  - 623680 - xen kernel freezes during boot when processor     module is loaded

  - 680824 - dom0 can't recognize boot disk when IOMMU is     enabled

  - 688473 - VUL-0: potential buffer overflow in tools

  - 679344 - VUL-0: Xen: multi-vCPU pv guest may crash host

  - 687981 - L3: mistyping model type when defining VIF     crashes

  - 675817 - Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871 - dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related

  - 678229 - restore of sles HVM fails

  - 672833 - xen-tools bug causing problems with Ubuntu     10.10 under Xen 4.

  - 665610 - xm console > 1 to same VM messes up both     consoles

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

From Red Hat Security Advisory 2011:0391 :

Updated libvirt packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems.

It was found that several libvirt API calls did not honor the read-only permission for connections. A local attacker able to establish a read-only connection to libvirtd on a server could use this flaw to execute commands that should be restricted to read-write connections, possibly leading to a denial of service or privilege escalation. (CVE-2011-1146)

Note: Previously, using rpmbuild without the '--define 'rhel 5'' option to build the libvirt source RPM on Red Hat Enterprise Linux 5 failed with a 'Failed build dependencies' error for the device-mapper-devel package, as this -devel sub-package is not available on Red Hat Enterprise Linux 5. With this update, the -devel sub-package is no longer checked by default as a dependency when building on Red Hat Enterprise Linux 5, allowing the libvirt source RPM to build as expected.

All libvirt users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

It was found that several libvirt API calls did not honor the read-only permission for connections. A local attacker able to establish a read-only connection to libvirtd on a server could use this flaw to execute commands that should be restricted to read-write connections, possibly leading to a denial of service or privilege escalation. (CVE-2011-1146)

Note: Previously, using rpmbuild without the '--define 'rhel 5'' option to build the libvirt source RPM could failed with a 'Failed build dependencies' error for the device-mapper-devel package, as this
-devel sub-package may not be available. With this update, the -devel sub-package is no longer checked by default as a dependency when building , allowing the libvirt source RPM to build as expected.

The remote host is affected by the vulnerability described in GLSA-201202-07 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow a remote attacker to cause a Denial of       Service condition on the host server or libvirt daemon, or  might allow       guest OS users to read arbitrary files on the host OS.
  Workaround :

    There is no known workaround at this time.

CVE-2011-2511, integer overflow in VirDomainGetVcpus

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Collective May/2011 update for Xen

Xen :

  - 679344: Xen: multi-vCPU pv guest may crash host

  - 675817: Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871: dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363: Random lockups with kernel-xen. Possibly     graphics related

  - 678229: restore of sles HVM fails

  - 672833: xen-tools bug causing problems with Ubuntu 10.10     under Xen 4.

  - 665610: xm console > 1 to same VM messes up both     consoles

  - 687981: mistyping model type when defining VIF crashes     VM

  - 688473: Fix potential buffer overflow in decode

  - 691238: revert accidental behaviour change in xm list

  - 680824: dom0 can't recognize boot disk when IOMMU is     enabled

  - 623680: xen kernel freezes during boot when processor     module is loaded vm-install :

  - 678152: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

  - 688757: SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic libvirt :

  - 674371: qemu aio mode per disk

  - 675861: Force FLR on for buggy SR-IOV devices

  - 678406: libvirt: several API calls do not honour     read-only

  - 684877: libvirt: error reporting in libvirtd is not     thread safe

  - 686737: virsh: Add option 'model' to attach-interface

  - 681546: Fix xmdomain.cfg to libvirt XML format     conversion

  - 688306: Handle support for recent KVM versions

Updated libvirt packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems.

It was found that several libvirt API calls did not honor the read-only permission for connections. A local attacker able to establish a read-only connection to libvirtd on a server could use this flaw to execute commands that should be restricted to read-write connections, possibly leading to a denial of service or privilege escalation. (CVE-2011-1146)

Note: Previously, using rpmbuild without the '--define 'rhel 5'' option to build the libvirt source RPM on Red Hat Enterprise Linux 5 failed with a 'Failed build dependencies' error for the device-mapper-devel package, as this -devel sub-package is not available on Red Hat Enterprise Linux 5. With this update, the -devel sub-package is no longer checked by default as a dependency when building on Red Hat Enterprise Linux 5, allowing the libvirt source RPM to build as expected.

All libvirt users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

Fix for CVE-2011-1486, error reporting in libvirtd is not thread safe Fix specfile to create /var/lib/libvirt with proper permissions. fix a lack of API check on read-only connections this build fix one crash in the the error handling fix a lack of API check on read-only connections

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2011-1486, error reporting in libvirtd is not thread safe Fix specfil to create /var/lib/libvirt with proper permissions. fix a lack of API check on read-only connections this build fix one crash in the the error handling fix a lack of API check on read-only connections

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Petr Matousek discovered that libvirt did not always honor read-only connections. An attacker who is authorized to connect to the libvirt daemon could exploit this to cause a denial of service via application crash.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0391 advisory.

  - libvirt: several API calls do not honour read-only connection (CVE-2011-1146)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

fix a lack of API check on read-only connections

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libvirt, a library for interfacing with different virtualization systems, did not properly check for read-only connections. This allowed a local attacker to perform a denial of service (crash) or possibly escalate privileges.

The oldstable distribution (lenny) is not affected by this problem.

ID	Name	Product	Family	Severity
76048	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0578-1)	Nessus	SuSE Local Security Checks	medium
75927	openSUSE Security Update : libvirt (openSUSE-SU-2011:0311-1)	Nessus	SuSE Local Security Checks	medium
75776	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0580-1)	Nessus	SuSE Local Security Checks	medium
75623	openSUSE Security Update : libvirt (openSUSE-SU-2011:0311-1)	Nessus	SuSE Local Security Checks	medium
68238	Oracle Linux 5 / 6 : libvirt (ELSA-2011-0391)	Nessus	Oracle Linux Local Security Checks	medium
61002	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
61001	Scientific Linux Security Update : libvirt on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58139	GLSA-201202-07 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
55656	Fedora 14 : libvirt-0.8.3-10.fc14 (2011-9062)	Nessus	Fedora Local Security Checks	medium
54934	SuSE 11.1 Security Update : Xen (SAT Patch Number 4491)	Nessus	SuSE Local Security Checks	medium
53762	openSUSE Security Update : libvirt (openSUSE-SU-2011:0311-1)	Nessus	SuSE Local Security Checks	medium
53577	CentOS 5 : libvirt (CESA-2011:0391)	Nessus	CentOS Local Security Checks	medium
53479	Fedora 13 : libvirt-0.8.2-6.fc13 (2011-4870)	Nessus	Fedora Local Security Checks	medium
53368	Fedora 14 : libvirt-0.8.3-9.fc14 (2011-4896)	Nessus	Fedora Local Security Checks	medium
53218	Ubuntu 9.10 / 10.04 LTS / 10.10 : libvirt vulnerability (USN-1094-1)	Nessus	Ubuntu Local Security Checks	medium
53205	RHEL 5 / 6 : libvirt (RHSA-2011:0391)	Nessus	Red Hat Local Security Checks	high
52726	Fedora 15 : libvirt-0.8.8-3.fc15 (2011-3286)	Nessus	Fedora Local Security Checks	medium
52718	Debian DSA-2194-1 : libvirt - insufficient checks	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-1146

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium