Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.

This update for libvirt fixes the following issues :

CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).

CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).

qemu: Avoid stale capabilities cache host CPU or kernel command line changes (bsc#1173157).

virdevmapper: Handle kernel without device-mapper support (bsc#1175465).

Xen: Added support for passing arbitrary commands to the qemu device model, similar to the xl.cfg(5) device_model_args setting (bsc#1174139).

Xen: Don't add dom0 twice on driver reload (bsc#1176430).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).

CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).

CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).

libxl: Fixed lock manager lock ordering (bsc#1171701).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).

CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).

qemu: Adjust max memlock on mdev hotplug (bsc#1177480).

Xen: Don't add dom0 twice on driver reload (bsc#1176430).

Fixed an issue where building was failing (bsc#1175574).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).

CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).

qemu: Adjust max memlock on mdev hotplug (bsc#1177480).

Xen: Don't add dom0 twice on driver reload (bsc#1176430).

virdevmapper: Handle kernel without device-mapper support (bsc#1175465).

Fixed an issue where building was failing (bsc#1175574).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

  - CVE-2020-15708: Added a note to libvirtd.conf about     polkit auth in SUSE distros (bsc#1174955).
    CVE-2020-25637: Fixed a double free in     qemuAgentGetInterfaces() (bsc#1177155).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

&#9; - CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).

  - CVE-2020-25637: Fixed a double free in     qemuAgentGetInterfaces() (bsc#1177155).

  - qemu: Adjust max memlock on mdev hotplug (bsc#1177480).

  - Xen: Don't add dom0 twice on driver reload     (bsc#1176430).

  - virdevmapper: Handle kernel without device-mapper     support (bsc#1175465).

  - Fixed an issue where building was failing (bsc#1175574).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for libvirt fixes the following issues :

  - CVE-2020-15708: Added a note to libvirtd.conf about     polkit auth in SUSE distros (bsc#1174955).

  - CVE-2020-25637: Fixed a double free in     qemuAgentGetInterfaces() (bsc#1177155).

  - qemu: Avoid stale capabilities cache host CPU or kernel     command line changes (bsc#1173157).

  - virdevmapper: Handle kernel without device-mapper     support (bsc#1175465).

  - Xen: Added support for passing arbitrary commands to the     qemu device model, similar to the xl.cfg(5)     device_model_args setting (bsc#1174139).

  - Xen: Don't add dom0 twice on driver reload     (bsc#1176430).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Trent Shea working with Trend Micro's Zero Day Initiative, discovered that the libvirt package set incorrect permissions on the UNIX domain socket. A local attacker could use this issue to access libvirt and escalate privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
143884	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:2970-1)	Nessus	SuSE Local Security Checks	high
143851	SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:3143-1)	Nessus	SuSE Local Security Checks	high
143850	SUSE SLES15 Security Update : libvirt (SUSE-SU-2020:2969-1)	Nessus	SuSE Local Security Checks	high
143827	SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:3038-1)	Nessus	SuSE Local Security Checks	high
143759	SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:3039-1)	Nessus	SuSE Local Security Checks	high
143649	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:3037-1)	Nessus	SuSE Local Security Checks	high
143635	SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:3095-1)	Nessus	SuSE Local Security Checks	high
142188	openSUSE Security Update : libvirt (openSUSE-2020-1778)	Nessus	SuSE Local Security Checks	high
142183	openSUSE Security Update : libvirt (openSUSE-2020-1777)	Nessus	SuSE Local Security Checks	high
139372	Ubuntu 20.04 LTS : libvirt vulnerability (USN-4452-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2020-15708

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high