The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0748 advisory.

  - libvirt: address bus= device= when identicle vendor ID/product IDs usb devices attached are ignored     (CVE-2012-2693)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Bus and device IDs were ignored when attempting to attach multiple USB devices with identical vendor or product IDs to a guest. This could result in the wrong device being attached to a guest, giving that guest root access to the device. (CVE-2012-2693)

These updated libvirt packages include numerous bug fixes and enhancements.

All users of libvirt are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

Updated libvirt packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Bus and device IDs were ignored when attempting to attach multiple USB devices with identical vendor or product IDs to a guest. This could result in the wrong device being attached to a guest, giving that guest root access to the device. (CVE-2012-2693)

This update also fixes the following bugs :

* Previously, the libvirtd library failed to set the autostart flags for already defined QEMU domains. This bug has been fixed, and the domains can now be successfully marked as autostarted. (BZ#675319)

* Prior to this update, the virFileAbsPath() function was not taking into account the slash ('/') directory separator when allocating memory for combining the cwd() function and a path. This behavior could lead to a memory corruption. With this update, a transformation to the virAsprintff() function has been introduced into virFileAbsPath(). As a result, the aforementioned behavior no longer occurs. (BZ#680289)

* With this update, a man page of the virsh user interface has been enhanced with information on the 'domxml-from-native' and 'domxml-to-native' commands. A correct notation of the format argument has been clarified. As a result, confusion is avoided when setting the format argument in the described commands. (BZ#783001)

All users of libvirt are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, libvirtd will be restarted automatically.

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-46:01 advisory.

    Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and     other OSes).
    Security issues fixed with this release:
     CVE-2012-2693     libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple     devices have the same vendor and product ID, which might cause the wrong device to be associated with a     guest and might allow local users to access unintended USB devices.
    Fixed bugs:
     The libvirtd library can now successfully set the autostart flags for previously defined QEMU domains, as     expected.
     Because the virFileAbsPath() function did not take into account the slash directory separator when     allocating memory for combining the cwd() function, a memory corruption could happen. This has been fixed:
    the virFileAbsPath() function now contains a transformation to the virAsprintff().
     Updated the man page with information on the domxml-from-native and domxml-to-native commands as well     as the correct notation for the format argument.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple     devices have the same vendor and product ID, which might cause the wrong device to be associated with a     guest and might allow local users to access unintended USB devices. (CVE-2012-2693)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-655:03 advisory.

    Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and     other OSes). The main package includes the libvirtd server exporting the virtualization support.
    Security issues fixed with this release:
     CVE-2012-2693     libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple     devices have the same vendor and product ID, which might cause the wrong device to be associated with a     guest and might allow local users to access unintended USB devices.
    Fixed bugs and enhancements:
     Fixed a locking problem in one of the routines involved in the migration process. This could cause     migratiosn to become unresponsive.
     Closing a file descriptor multiple times could sometimes lead to a failure to execute the qemu-kvm binary     and a guest could fail to start. This has been fixed.
     Because the keepalive checking function, to detect broken connections between the client and the server,     could be buggy at times and cause a failure of service and disconnection, it has been disabled by default.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated libvirt packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Bus and device IDs were ignored when attempting to attach multiple USB devices with identical vendor or product IDs to a guest. This could result in the wrong device being attached to a guest, giving that guest root access to the device. (CVE-2012-2693)

These updated libvirt packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most significant of these changes.

All users of libvirt are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

Bus and device IDs were ignored when attempting to attach multiple USB devices with identical vendor or product IDs to a guest. This could result in the wrong device being attached to a guest, giving that guest root access to the device. (CVE-2012-2693)

This update also fixes the following bugs :

  - Previously, the libvirtd library failed to set the     autostart flags for already defined QEMU domains. This     bug has been fixed, and the domains can now be     successfully marked as autostarted.

  - Prior to this update, the virFileAbsPath() function was     not taking into account the slash ('/') directory     separator when allocating memory for combining the cwd()     function and a path. This behavior could lead to a     memory corruption. With this update, a transformation to     the virAsprintff() function has been introduced into     virFileAbsPath(). As a result, the aforementioned     behavior no longer occurs.

  - With this update, a man page of the virsh user interface     has been enhanced with information on the     'domxml-from-native' and 'domxml-to-native' commands. A     correct notation of the format argument has been     clarified. As a result, confusion is avoided when     setting the format argument in the described commands.

After installing the updated packages, libvirtd will be restarted automatically.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0127 advisory.

    [0.8.2-29.0.1.el5]
    - Replaced docs/et.png in tarball
    - remove virshtest from test cases to fix failure in mock build root

    [libvirt-0.8.2-29.el5]
    - Coverity pointed out an use after free in the fix for 816601 (rhbz#772848)

    [libvirt-0.8.2-28.el5]
    - qemu: Rollback on used USB devices (rhbz#816601)
    - qemu: Don't delete USB device on failed qemuPrepareHostdevUSBDevices (rhbz#816601)

    [libvirt-0.8.2-27.el5]
    - qemu: Delete USB devices used by domain on stop (rhbz#816601)

    [libvirt-0.8.2-26.el5]
    - Fix off-by-1 in virFileAbsPath. (rhbz#680289)
    - Fix autostart flag when loading running domains (rhbz#675319)
    - node_device: Avoid null dereference on error (rhbz#772848)
    - util: Avoid null deref on qcowXGetBackingStore (rhbz#772848)
    - docs: Improve virsh domxml-*-native command docs (rhbz#783001)
    - Clarify the purpose of domxml-from-native (rhbz#783001)
    - qemu: Add return value check (rhbz#772821)
    - storage: Avoid mishandling backing store > 2GB (rhbz#772821)
    - util: Avoid PATH_MAX-sized array (rhbz#816601)
    - qemu: Keep list of USB devices attached to domains (rhbz#816601)
    - qemu: Don't leak temporary list of USB devices (rhbz#816601)
    - usb: Create functions to search usb device accurately (rhbz#816601)
    - qemu: Call usb search function for hostdev initialization and hotplug (rhbz#816601)
    - usb: Fix crash when failing to attach a second usb device (rhbz#816601)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
59584	RHEL 6 : libvirt (RHSA-2012:0748)	Nessus	Red Hat Local Security Checks	6/20/2012	4/27/2024	critical
61340	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20120620)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	low
64073	RHEL 5 : libvirt (RHSA-2013:0127)	Nessus	Red Hat Local Security Checks	1/24/2013	1/14/2021	low
289377	MiracleLinux 3 : libvirt-0.8.2-29.0.1.AXS3 (AXSA:2013-46:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
68547	Oracle Linux 6 : libvirt (ELSA-2012-0748)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical
217625	Linux Distros Unpatched Vulnerability : CVE-2012-2693	Nessus	Misc.	3/4/2025	1/28/2026	critical
284431	MiracleLinux 4 : libvirt-0.9.10-21.1.0.1.AXS4 (AXSA:2012-655:03)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	critical
59918	CentOS 6 : libvirt (CESA-2012:0748)	Nessus	CentOS Local Security Checks	7/11/2012	1/4/2021	low
63572	CentOS 5 : libvirt (CESA-2013:0127)	Nessus	CentOS Local Security Checks	1/17/2013	1/4/2021	low
63598	Scientific Linux Security Update : libvirt on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	1/17/2013	1/14/2021	low
68698	Oracle Linux 5 : libvirt (ELSA-2013-0127)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical

Detections

Analytics

Plugins Search

critical

low

low

critical

critical

critical

critical

low

low

low

critical