The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1580 advisory.

  - The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1,     accepts an emulatorbin argument to specify the program providing emulation for a domain. Since v1.2.19,     libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an     arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own     privileges. (CVE-2019-10167)

  - The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before     4.10.1 and 5.x.x before 5.4.1, accept an emulator argument to specify the program providing emulation     for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-     only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted     executable with its own privileges. (CVE-2019-10168)

  - It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to     probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary     programs. (CVE-2019-10161)

  - It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit     readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed     save state files. If a managed save had already been created by a privileged user, a local attacker could     modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.
    (CVE-2019-10166)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-18 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local privileged attacker could execute arbitrary commands, escalate       privileges or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of the libvirt package has been released.

According to the versions of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that libvirtd would permit read-only     clients to use the virDomainSaveImageGetXMLDesc() API,     specifying an arbitrary path which would be accessed     with the permissions of the libvirtd process. An     attacker with access to the libvirtd socket could use     this to probe the existence of arbitrary files, cause     denial of service or cause libvirtd to execute     arbitrary programs. (CVE-2019-10161)

  - The virConnectGetDomainCapabilities() libvirt API     accepts an 'emulatorbin' argument to specify the     program providing emulation for a domain. Since     v1.2.19, libvirt will execute that program to probe the     domain's capabilities. Read-only clients could specify     an arbitrary path for this argument, causing libvirtd     to execute a crafted executable with its own     privileges. (CVE-2019-10167)

  - The virConnectBaselineHypervisorCPU() and     virConnectCompareHypervisorCPU() libvirt APIs accept an     'emulator' argument to specify the program providing     emulation for a domain. Since v1.2.19, libvirt will     execute that program to probe the domain's     capabilities. Read-only clients could specify an     arbitrary path for this argument, causing libvirtd to     execute a crafted executable with its own privileges.
    (CVE-2019-10168)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
(CVE-2019-11091)

Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

The virConnectGetDomainCapabilities() libvirt API accepts an 'emulatorbin' argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. (CVE-2019-10167)

It was discovered that libvirtd would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. (CVE-2019-10166)

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.(CVE-2019-10132)

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs accept an 'emulator' argument to specify the program providing emulation for a domain.
Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. (CVE-2019-10168)

It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process.
An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. (CVE-2019-10161)

Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127)

A flaw was found in the implementation of the 'fill buffer', a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130)

According to the versions of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libvirt: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to     readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via     virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issues fixed: &#9; 

  - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API     which could accept a path parameter pointing anywhere on     the system and potentially leading to execution of a     malicious file with root privileges by libvirtd     (bsc#1138301). 

  - CVE-2019-10166: Fixed an issue with     virDomainManagedSaveDefineXML which could have been used     to alter the domain's config used for managedsave or     execute arbitrary emulator binaries (bsc#1138302).

  - CVE-2019-10167: Fixed an issue with     virConnectGetDomainCapabilities API which could have     been used to execute arbitrary emulators (bsc#1138303).

  - CVE-2019-10168: Fixed an issue with     virConnect*HypervisorCPU API which could have been used     to execute arbitrary emulators (bsc#1138305).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1762 advisory.

  - libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Description of changes:

[5.0.0-9.el7]
- qemu: remove cpuhostmask and cpuguestmask from virCaps structure (Wim ten Have) [Orabug: 29956508]

[5.0.0-8.el7]
- api: disallow virDomainSaveImageGetXMLDesc on read-only connections (J&aacute n Tomko) [Orabug: 29955742] {CVE-2019-10161}
- domain: Define explicit flags for saved image xml (Eric Blake) [Orabug: 29955742]
- api: disallow virDomainManagedSaveDefineXML on read-only connections (J&aacute n Tomko) [Orabug: 29955742] {CVE-2019-10166}
- api: disallow virConnectGetDomainCapabilities on read-only connections (J&aacute n Tomko) [Orabug: 29955742] {CVE-2019-10167}
- api: disallow virConnect*HypervisorCPU on read-only connections (J&aacute n Tomko) [Orabug: 29955742] {CVE-2019-10168}

[5.0.0-7.el7]
- cpu_map: Define md-clear CPUID bit (Jiri Denemark) [Orabug: 29874181] {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}

[5.0.0-6.el7]
- qemu: Driver change adding private lock to auto-tune hugepages (Wim ten Have) [Orabug: 29809943]

[5.0.0-5.el7]
- qemu: disable setmem change requests for vNUMA targets (Wim ten Have) [Orabug: 29797366]
- domain: Disable memballoon memory configuration support for vNUMA guests (Wim ten Have) [Orabug: 29797366]
- qemu: Driver change to target for vNUMA setmaxmem change request (Wim ten Have) [Orabug: 29749852]
- domain: Add domain memory config support for vNUMA guests (Wim ten Have) [Orabug: 29749852]
- logging: restrict sockets to mode 0600 (Daniel P. Berrang&eacute ) [Orabug: 29861433] {CVE-2019-10132}
- locking: restrict sockets to mode 0600 (Daniel P. Berrang&eacute ) [Orabug: 29861433] {CVE-2019-10132}
- admin: reject clients unless their UID matches the current UID (Daniel P. Berrang&eacute ) [Orabug: 29861433] {CVE-2019-10132}

Matthias Gerstner and Jan Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to check for arbitrary files, or execute arbitrary binaries. In the default installation, attackers would be isolated by the libvirt AppArmor profile.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1699 advisory.

  - libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

  - Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service     (CVE-2019-11477)

  - Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service     (CVE-2019-11478)

  - kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of     service (CVE-2019-11479)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Cannot start VM with a CBR 2.0 TPM device (bz #1712556)

  - libvirtd does not update VM .xml configurations after     virsh snapshot/blockcommit (bz #1722348)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-10161: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (bz #1722463, bz     #1720115)

  - CVE-2019-10166: virDomainManagedSaveDefineXML API     exposed to readonly clients (bz #1722462, bz #1720114)

  - CVE-2019-10167: arbitrary command execution via     virConnectGetDomainCapabilities API (bz #1722464, bz     #1720117)

  - CVE-2019-10168: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (bz #1722466, bz     #1720118)

  - CVE-2019-3886: virsh domhostname command discloses guest     hostname in readonly mode [fedora-rawhide

  - Failed to attache NEW rbd device to guest (bz #1672620)

  - PCI hostdev interface segfault (bz #1692053)

----

Fix systemd socket permissions (CVE-2019-10132) The virtlockd-admin.socket, virtlogd-admin.sock, virtlockd.socket & virtlogd.socket units must be restarted, if currently running. This can be done with a host reboot or systemctl commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

Security issues fixed :

CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd (bsc#1138301).

CVE-2019-10166: Fixed an issue with virDomainManagedSaveDefineXML which could have been used to alter the domain's config used for managedsave or execute arbitrary emulator binaries (bsc#1138302).

CVE-2019-10167: Fixed an issue with virConnectGetDomainCapabilities API which could have been used to execute arbitrary emulators (bsc#1138303).

CVE-2019-10168: Fixed an issue with virConnect*HypervisorCPU API which could have been used to execute arbitrary emulators (bsc#1138305).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2019:1579 :

An update for libvirt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.
In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es) :

* libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

* libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

* libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

* libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Live migration fail with unsafe error when GPFS is used as shared filesystem (BZ#1715867)

Security Fix(es) :

  - libvirt: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to     readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via     virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

Bug Fix(es) :

  - Live migration fail with unsafe error when GPFS is used     as shared filesystem

Security Fix(es) :

  - libvirt: arbitrary file read/exec via     virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to     readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via     virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via     virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1580 advisory.

  - libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1579 advisory.

  - libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

  - libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

  - libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

  - libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and     virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for libvirt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems.
In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es) :

* libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

* libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166)

* libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167)

* libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (CVE-2019-10168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Live migration fail with unsafe error when GPFS is used as shared filesystem (BZ#1715867)

ID	Name	Product	Family	Severity
180761	Oracle Linux 8 : virt:rhel (ELSA-2019-1580)	Nessus	Oracle Linux Local Security Checks	high
134595	GLSA-202003-18 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
130112	Photon OS 3.0: Libvirt PHSA-2019-3.0-0032	Nessus	PhotonOS Local Security Checks	high
128960	EulerOS Virtualization for ARM 64 3.0.2.0 : libvirt (EulerOS-SA-2019-1957)	Nessus	Huawei Local Security Checks	high
128288	Amazon Linux 2 : libvirt (ALAS-2019-1274) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Amazon Linux Local Security Checks	high
127011	EulerOS 2.0 SP8 : libvirt (EulerOS-SA-2019-1774)	Nessus	Huawei Local Security Checks	high
126894	openSUSE Security Update : libvirt (openSUSE-2019-1753)	Nessus	SuSE Local Security Checks	high
126679	RHEL 8 : virt:8.0.0 (RHSA-2019:1762)	Nessus	Red Hat Local Security Checks	high
126674	Oracle Linux 7 : libvirt (ELSA-2019-4714) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Oracle Linux Local Security Checks	high
126563	Ubuntu 16.04 LTS / 18.04 LTS : libvirt vulnerabilities (USN-4047-1)	Nessus	Ubuntu Local Security Checks	high
126559	RHEL 7 : redhat-virtualization-host (RHSA-2019:1699)	Nessus	Red Hat Local Security Checks	high
126532	Fedora 30 : libvirt (2019-b2dfb13daf)	Nessus	Fedora Local Security Checks	high
126531	Fedora 29 : libvirt (2019-9210998aaa)	Nessus	Fedora Local Security Checks	high
126166	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2019:1643-1)	Nessus	SuSE Local Security Checks	high
126141	Oracle Linux 7 : libvirt (ELSA-2019-1579)	Nessus	Oracle Linux Local Security Checks	high
126091	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20190620)	Nessus	Scientific Linux Local Security Checks	high
126090	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20190620)	Nessus	Scientific Linux Local Security Checks	high
126088	RHEL 8 : virt:rhel (RHSA-2019:1580)	Nessus	Red Hat Local Security Checks	high
126087	RHEL 7 : libvirt (RHSA-2019:1579)	Nessus	Red Hat Local Security Checks	high
126076	CentOS 7 : libvirt (CESA-2019:1579)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2019-10168

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high