The virSecurityManagerGetPrivateData function in security/security_manager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users to read arbitrary files on the host OS. NOTE: this vulnerability exists because of a CVE-2010-2238 regression.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The virSecurityManagerGetPrivateData function in security/security_manager.c in libvirt 0.8.8 through     0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of security manager     private data that reopens disk probing and might allow guest OS users to read arbitrary files on the     host OS. NOTE: this vulnerability exists because of a CVE-2010-2238 regression. (CVE-2011-2178)

Note that Nessus relies on the presence of the package as reported by the vendor.

A regression re-introduced automatic disk probing again which potentially allowed to uses to access arbitrary files (CVE-2011-2178).

The remote host is affected by the vulnerability described in GLSA-201202-07 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow a remote attacker to cause a Denial of       Service condition on the host server or libvirt daemon, or  might allow       guest OS users to read arbitrary files on the host OS.
  Workaround :

    There is no known workaround at this time.

Fix for CVE-2011-2178, regression introduced in disk probe logic,

Fix for CVE-2011-2511, integer overflow in VirDomainGetVcpus

Make commandtest more robust,

Add ARM to NUMA excludes

Add several build and runtime dependencies to specfile

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libvirt did not use thread-safe error reporting. A remote attacker could exploit this to cause a denial of service via application crash. (CVE-2011-1486)

Eric Blake discovered that libvirt had an off-by-one error which could be used to reopen disk probing and bypass the fix for CVE-2010-2238. A privileged attacker in the guest could exploit this to read arbitrary files on the host. This issue only affected Ubuntu 11.04. By default, guests are confined by an AppArmor profile which provided partial protection against this flaw. (CVE-2011-2178).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
217513	Linux Distros Unpatched Vulnerability : CVE-2011-2178	Nessus	Misc.	high
75929	openSUSE Security Update : libvirt (openSUSE-SU-2011:0643-1)	Nessus	SuSE Local Security Checks	medium
58139	GLSA-201202-07 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
55561	Fedora 15 : libvirt-0.8.8-7.fc15 (2011-9091)	Nessus	Fedora Local Security Checks	medium
55167	Ubuntu 10.04 LTS / 10.10 / 11.04 : libvirt vulnerabilities (USN-1152-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-2178

medium

Tenable Plugins

high

medium

medium

medium

medium