libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which allows remote attackers to cause a denial of service (crash) by causing multiple threads to report errors at the same time.

Collective May/2011 update for Xen

Xen :

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related.

  - 679344 - Xen: multi-vCPU pv guest may crash host

  - 681044 - update xenpaging.autostart.patch

  - 681302 - xm create -x <guest> returns 'ImportError: No     module named ext'

  - 688473 - potential buffer overflow in tools

  - 691738 - Xen does not find device create with npiv block

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

  - 631680 - OpenSUSE 11.3 KVM install of windows xp fails     on first reboot during installation.

libvirtd could mix errors from several threads leading to a crash (CVE-2011-1486).

Collective May/2011 update for Xen

Xen :

  - 691238 - L3: question on behaviour change xm list

  - 623680 - xen kernel freezes during boot when processor     module is loaded

  - 680824 - dom0 can't recognize boot disk when IOMMU is     enabled

  - 688473 - VUL-0: potential buffer overflow in tools

  - 679344 - VUL-0: Xen: multi-vCPU pv guest may crash host

  - 687981 - L3: mistyping model type when defining VIF     crashes

  - 675817 - Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871 - dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363 - Random lockups with kernel-xen. Possibly     graphics related

  - 678229 - restore of sles HVM fails

  - 672833 - xen-tools bug causing problems with Ubuntu     10.10 under Xen 4.

  - 665610 - xm console > 1 to same VM messes up both     consoles

vm-install :

  - 688757 - SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic

  - 678152 - Xen: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

From Red Hat Security Advisory 2011:0479 :

Updated libvirt packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems.

A flaw was found in the way libvirtd handled error reporting for concurrent connections. A remote attacker able to establish read-only connections to libvirtd on a server could use this flaw to crash libvirtd. (CVE-2011-1486)

This update also fixes the following bug :

* Previously, running qemu under a different UID prevented it from accessing files with mode 0660 permissions that were owned by a different user, but by a group that qemu was a member of. (BZ#668692)

All libvirt users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

From Red Hat Security Advisory 2011:0478 :

Updated libvirt packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems.

A flaw was found in the way libvirtd handled error reporting for concurrent connections. A remote attacker able to establish read-only connections to libvirtd on a server could use this flaw to crash libvirtd. (CVE-2011-1486)

All libvirt users are advised to upgrade to these updated packages, which contain backported patches to resolve this issue. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0478 advisory.

  - libvirt: error reporting in libvirtd is not thread safe (CVE-2011-1486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way libvirtd handled error reporting for concurrent connections. A remote attacker able to establish read-only connections to libvirtd on a server could use this flaw to crash libvirtd. (CVE-2011-1486)

libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201202-07 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow a remote attacker to cause a Denial of       Service condition on the host server or libvirt daemon, or  might allow       guest OS users to read arbitrary files on the host OS.
  Workaround :

    There is no known workaround at this time.

It was discovered that libvirt, a library for interfacing with different virtualization systems, is prone to an integer overflow (CVE-2011-2511 ). Additionally, the stable version is prone to a denial of service, because its error reporting is not thread-safe (CVE-2011-1486 ).

It was discovered that libvirt did not use thread-safe error reporting. A remote attacker could exploit this to cause a denial of service via application crash. (CVE-2011-1486)

Eric Blake discovered that libvirt had an off-by-one error which could be used to reopen disk probing and bypass the fix for CVE-2010-2238. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 11.04. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2011-2178).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Collective May/2011 update for Xen

Xen :

  - 679344: Xen: multi-vCPU pv guest may crash host

  - 675817: Kernel panic when creating HVM guests on AMD     platforms with XSAVE

  - 678871: dom0 hangs long time when starting hvm guests     with memory >= 64GB

  - 675363: Random lockups with kernel-xen. Possibly     graphics related

  - 678229: restore of sles HVM fails

  - 672833: xen-tools bug causing problems with Ubuntu 10.10     under Xen 4.

  - 665610: xm console > 1 to same VM messes up both     consoles

  - 687981: mistyping model type when defining VIF crashes     VM

  - 688473: Fix potential buffer overflow in decode

  - 691238: revert accidental behaviour change in xm list

  - 680824: dom0 can't recognize boot disk when IOMMU is     enabled

  - 623680: xen kernel freezes during boot when processor     module is loaded vm-install :

  - 678152: virt-manager: harmless block device admin     actions on FV guests mess up network (VIF) device type     ==> network lost.

  - 688757: SLED10SP4 fully virtualized in SLES10SP4 XEN -     kernel panic libvirt :

  - 674371: qemu aio mode per disk

  - 675861: Force FLR on for buggy SR-IOV devices

  - 678406: libvirt: several API calls do not honour     read-only

  - 684877: libvirt: error reporting in libvirtd is not     thread safe

  - 686737: virsh: Add option 'model' to attach-interface

  - 681546: Fix xmdomain.cfg to libvirt XML format     conversion

  - 688306: Handle support for recent KVM versions

Updated libvirt packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remotely managing virtualized systems.

A flaw was found in the way libvirtd handled error reporting for concurrent connections. A remote attacker able to establish read-only connections to libvirtd on a server could use this flaw to crash libvirtd. (CVE-2011-1486)

All libvirt users are advised to upgrade to these updated packages, which contain backported patches to resolve this issue. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0479 advisory.

  - libvirt: error reporting in libvirtd is not thread safe (CVE-2011-1486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix for CVE-2011-1486, error reporting in libvirtd is not thread safe Fix specfile to create /var/lib/libvirt with proper permissions. fix a lack of API check on read-only connections this build fix one crash in the the error handling fix a lack of API check on read-only connections

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2011-1486, error reporting in libvirtd is not thread safe

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2011-1486, error reporting in libvirtd is not thread safe Fix specfil to create /var/lib/libvirt with proper permissions. fix a lack of API check on read-only connections this build fix one crash in the the error handling fix a lack of API check on read-only connections

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76048	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0578-1)	Nessus	SuSE Local Security Checks	medium
75928	openSUSE Security Update : libvirt (openSUSE-SU-2011:0317-1)	Nessus	SuSE Local Security Checks	low
75776	openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0580-1)	Nessus	SuSE Local Security Checks	medium
75624	openSUSE Security Update : libvirt (openSUSE-SU-2011:0317-1)	Nessus	SuSE Local Security Checks	low
68268	Oracle Linux 6 : libvirt (ELSA-2011-0479)	Nessus	Oracle Linux Local Security Checks	low
68267	Oracle Linux 5 : libvirt (ELSA-2011-0478)	Nessus	Oracle Linux Local Security Checks	low
63979	RHEL 5 : libvirt (RHSA-2011:0478)	Nessus	Red Hat Local Security Checks	critical
61031	Scientific Linux Security Update : libvirt on SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
58139	GLSA-201202-07 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
55625	Debian DSA-2280-1 : libvirt - several vulnerabilities	Nessus	Debian Local Security Checks	medium
55167	Ubuntu 10.04 LTS / 10.10 / 11.04 : libvirt vulnerabilities (USN-1152-1)	Nessus	Ubuntu Local Security Checks	medium
54934	SuSE 11.1 Security Update : Xen (SAT Patch Number 4491)	Nessus	SuSE Local Security Checks	medium
53763	openSUSE Security Update : libvirt (openSUSE-SU-2011:0317-1)	Nessus	SuSE Local Security Checks	low
53643	CentOS 5 : libvirt / libvirt.test (CESA-2011:0478)	Nessus	CentOS Local Security Checks	low
53631	RHEL 6 : libvirt (RHSA-2011:0479)	Nessus	Red Hat Local Security Checks	critical
53479	Fedora 13 : libvirt-0.8.2-6.fc13 (2011-4870)	Nessus	Fedora Local Security Checks	medium
53455	Fedora 15 : libvirt-0.8.8-4.fc15 (2011-4964)	Nessus	Fedora Local Security Checks	low
53368	Fedora 14 : libvirt-0.8.3-9.fc14 (2011-4896)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1486

critical

Tenable Plugins

medium

low

medium

low

low

low

critical

low

medium

medium

medium

medium

low

low

critical

medium

low

medium