Summary
Detail | |||
---|---|---|---|
Vendor | Redhat | First view | 2014-11-13 |
Product | Libvirt | Last view | 2024-08-30 |
Version | 1.2.9 | Type | Application |
Update | rc2 | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:a:redhat:libvirt |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
6.2 | 2024-08-30 | CVE-2024-8235 | A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon. |
6.5 | 2022-08-23 | CVE-2021-3975 | A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash. |
6.5 | 2022-03-25 | CVE-2021-4147 | A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service condition. |
6.5 | 2022-03-02 | CVE-2021-3667 | An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. |
6.3 | 2022-03-02 | CVE-2021-3631 | A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity. |
6.5 | 2021-05-27 | CVE-2020-14301 | An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command. |
6.5 | 2021-05-27 | CVE-2020-10701 | A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0. |
6.5 | 2021-05-24 | CVE-2021-3559 | A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices (e.g., GRID driver). This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt daemon by executing the 'nodedev-list' virsh command. The highest threat from this vulnerability is to system availability. |
8.8 | 2020-12-03 | CVE-2020-14339 | A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. |
6.7 | 2020-10-06 | CVE-2020-25637 | A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
6.5 | 2020-06-02 | CVE-2020-10703 | A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service. |
6.5 | 2020-04-28 | CVE-2020-12430 | An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service. |
5.7 | 2020-03-19 | CVE-2019-20485 | qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage). |
7.8 | 2019-08-02 | CVE-2019-10168 | The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. |
7.8 | 2019-08-02 | CVE-2019-10167 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. |
7.8 | 2019-08-02 | CVE-2019-10166 | It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. |
7.8 | 2019-07-30 | CVE-2019-10161 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. |
8.8 | 2019-05-22 | CVE-2019-10132 | A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. |
7.5 | 2019-04-18 | CVE-2016-10746 | libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886. |
5.4 | 2019-04-04 | CVE-2019-3886 | An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block. |
6.3 | 2019-03-27 | CVE-2019-3840 | A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service. |
6.5 | 2018-08-22 | CVE-2017-2635 | A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives. A remote authenticated attacker could use this flaw to crash libvirtd daemon resulting in denial of service. |
7.5 | 2018-03-28 | CVE-2018-1064 | libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent. |
8.1 | 2017-10-31 | CVE-2017-1000256 | libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default. |
9.8 | 2016-07-13 | CVE-2016-5008 | libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
16% (4) | CWE-476 | NULL Pointer Dereference |
12% (3) | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path ... |
8% (2) | CWE-732 | Incorrect Permission Assignment for Critical Resource |
8% (2) | CWE-667 | Insufficient Locking |
8% (2) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
4% (1) | CWE-772 | Missing Release of Resource after Effective Lifetime |
4% (1) | CWE-416 | Use After Free |
4% (1) | CWE-415 | Double Free |
4% (1) | CWE-401 | Failure to Release Memory Before Removing Last Reference ('Memory L... |
4% (1) | CWE-295 | Certificate Issues |
4% (1) | CWE-284 | Access Control (Authorization) Issues |
4% (1) | CWE-264 | Permissions, Privileges, and Access Controls |
4% (1) | CWE-255 | Credentials Management |
4% (1) | CWE-254 | Security Features |
4% (1) | CWE-212 | Improper Cross-boundary Removal of Sensitive Data |
4% (1) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
4% (1) | CWE-20 | Improper Input Validation |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2019-01-10 | Name: The remote device is affected by multiple vulnerabilities. File: juniper_space_jsa10917_184R1.nasl - Type: ACT_GATHER_INFO |
2018-09-18 | Name: The remote EulerOS Virtualization host is missing multiple security updates. File: EulerOS_SA-2018-1253.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-1_0-0129.nasl - Type: ACT_GATHER_INFO |
2018-08-17 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2017-0052.nasl - Type: ACT_GATHER_INFO |
2018-07-26 | Name: The remote Amazon Linux 2 host is missing a security update. File: al2_ALAS-2018-1049.nasl - Type: ACT_GATHER_INFO |
2018-07-24 | Name: The remote PhotonOS host is missing multiple security updates. File: PhotonOS_PHSA-2018-2_0-0039.nasl - Type: ACT_GATHER_INFO |
2018-07-03 | Name: The remote EulerOS host is missing multiple security updates. File: EulerOS_SA-2018-1197.nasl - Type: ACT_GATHER_INFO |
2018-06-22 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2018-1929.nasl - Type: ACT_GATHER_INFO |
2018-05-31 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2018-1396.nasl - Type: ACT_GATHER_INFO |
2018-03-27 | Name: The remote Debian host is missing a security update. File: debian_DLA-1315.nasl - Type: ACT_GATHER_INFO |
2018-03-15 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-4137.nasl - Type: ACT_GATHER_INFO |
2018-01-15 | Name: The remote Fedora host is missing a security update. File: fedora_2017-b16cdbdc34.nasl - Type: ACT_GATHER_INFO |
2017-10-30 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2017-1213.nasl - Type: ACT_GATHER_INFO |
2017-10-26 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2017-2850-1.nasl - Type: ACT_GATHER_INFO |
2017-10-20 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-4003.nasl - Type: ACT_GATHER_INFO |
2017-05-01 | Name: The remote EulerOS host is missing a security update. File: EulerOS_SA-2017-1053.nasl - Type: ACT_GATHER_INFO |
2017-05-01 | Name: The remote EulerOS host is missing a security update. File: EulerOS_SA-2017-1052.nasl - Type: ACT_GATHER_INFO |
2016-12-15 | Name: The remote Scientific Linux host is missing one or more security updates. File: sl_20161103_libvirt_on_SL7_x.nasl - Type: ACT_GATHER_INFO |
2016-11-28 | Name: The remote CentOS host is missing one or more security updates. File: centos_RHSA-2016-2577.nasl - Type: ACT_GATHER_INFO |
2016-11-11 | Name: The remote Oracle Linux host is missing one or more security updates. File: oraclelinux_ELSA-2016-2577.nasl - Type: ACT_GATHER_INFO |
2016-11-07 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2016-2725-1.nasl - Type: ACT_GATHER_INFO |
2016-11-04 | Name: The remote Red Hat host is missing one or more security updates. File: redhat-RHSA-2016-2577.nasl - Type: ACT_GATHER_INFO |
2016-10-26 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2016-2533-1.nasl - Type: ACT_GATHER_INFO |
2016-10-26 | Name: The remote SUSE host is missing one or more security updates. File: suse_SU-2016-2528-1.nasl - Type: ACT_GATHER_INFO |
2016-10-12 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2016-1170.nasl - Type: ACT_GATHER_INFO |