The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete     arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container;
    (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the     container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4)     virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under     /proc/$PID/root and the virInitctlSetRunLevel function. (CVE-2013-6456)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated libvirt packages fix security vulnerabilities :

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456).

libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179).

An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process (CVE-2014-3633).

A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive (CVE-2014-3657).

Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file (CVE-2014-7823).

The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors (CVE-2014-8136).

The XML getters for for save images and snapshots objects don't check ACLs for the VIR_DOMAIN_XML_SECURE flag and might possibly dump security sensitive information. A remote attacker able to establish a connection to libvirtd could use this flaw to cause leak certain limited information from the domain xml file (CVE-2015-0236).

The remote host is affected by the vulnerability described in GLSA-201412-04 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service or cause       information leakage. A local attacker may be able to escalate privileges,       cause a Denial of Service or possibly execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

libvirt was updated to fix various bugs and security issues :

CVE-2013-7336: libvirt: unprivileged user can crash libvirtd during spice migration

CVE-2013-6456: unsafe usage of paths under /proc/$PID/root

Bugfixes for libvirt client killed on reboot shutdown. (bnc#852005)

Also notify systemd when we are ready to accept connections.

libvirt has been patched to fix two security issues.

Further information is available at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0179 and http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6456

These security issues have been fixed :

  - Unsafe parsing of XML documents allows arbitrary file     read or denial of service. (CVE-2014-0179)

  - Ability to delete or create arbitrary host devices     (CVE-2013-6456)

Multiple vulnerabilities has been discovered and corrected in libvirt :

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function (CVE-2013-6456).

libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179).

The updated packages have been upgraded to the 1.1.3.5 version and patched to correct these issues.

It was discovered that libvirt incorrectly handled symlinks when using the LXC driver. An attacker could possibly use this issue to delete host devices, create arbitrary nodes, and shutdown or power off the host. (CVE-2013-6456)

Marian Krcmarik discovered that libvirt incorrectly handled seamless SPICE migrations. An attacker could possibly use this issue to cause a denial of service. (CVE-2013-7336).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebased to version 1.1.3.4

    - Fix domain events when ACLs are used (bz #1058839)

    - CVE-2013-6456: unsafe usage of paths under /proc//root       (bz #1048628, bz #1048627)

    - Fix baselineCPU EXPAND_FEATURES (bz #1049391)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
218064	Linux Distros Unpatched Vulnerability : CVE-2013-6456	Nessus	Misc.	Local	medium
82368	Mandriva Linux Security Advisory : libvirt (MDVSA-2015:115)	Nessus	Mandriva Local Security Checks	Local	medium
79814	GLSA-201412-04 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
75338	openSUSE Security Update : libvirt (openSUSE-SU-2014:0593-1)	Nessus	SuSE Local Security Checks	Local	medium
74507	SuSE 11.3 Security Update : libvirt (SAT Patch Number 9203)	Nessus	SuSE Local Security Checks	Local	medium
74075	Mandriva Linux Security Advisory : libvirt (MDVSA-2014:097)	Nessus	Mandriva Local Security Checks	Local	medium
73940	Ubuntu 13.10 : libvirt vulnerabilities (USN-2209-1)	Nessus	Ubuntu Local Security Checks	Local	medium
72753	Fedora 20 : libvirt-1.1.3.4-1.fc20 (2014-2864)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-6456

high

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium