CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (CVE-2020-25637)

• QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c (CVE-2020-27821)

• QEMU: ide: atapi: OOB access while processing read commands (CVE-2020-29443)

• QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure (CVE-2020-11947)

• QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (CVE-2020-16092)

• QEMU: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c (CVE-2020-25707)

• QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c (CVE-2020-25723)

• QEMU: e1000e: infinite loop scenario in case of null packet descriptor (CVE-2020-28916)

• QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets (CVE-2020-29129, CVE-2020-29130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (CVE-2020-25637)

• QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c (CVE-2020-27821)

• QEMU: ide: atapi: OOB access while processing read commands (CVE-2020-29443)

• QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure (CVE-2020-11947)

• QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (CVE-2020-16092)

• QEMU: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c (CVE-2020-25707)

• QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c (CVE-2020-25723)

• QEMU: e1000e: infinite loop scenario in case of null packet descriptor (CVE-2020-28916)

• QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets (CVE-2020-29129, CVE-2020-29130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A double free memory issue was found to occur in the libvirt API responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2020-25637).

This update for libvirt fixes the following issues:

• CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).
• CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).
• qemu: Avoid stale capabilities cache host CPU or kernel command line changes (bsc#1173157).
• virdevmapper: Handle kernel without device-mapper support (bsc#1175465).
• Xen: Added support for passing arbitrary commands to the qemu device model, similar to the xl.cfg(5) device_model_args setting (bsc#1174139).
• Xen: Don't add dom0 twice on driver reload (bsc#1176430).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for libvirt fixes the following issues:

• CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).
• CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).
• qemu: Adjust max memlock on mdev hotplug (bsc#1177480).
• Xen: Don't add dom0 twice on driver reload (bsc#1176430).
• virdevmapper: Handle kernel without device-mapper support (bsc#1175465).
• Fixed an issue where building was failing (bsc#1175574).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the libvirt-7.7.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libvirt fixes the following issues:

• CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).
• CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).
• libxl: Fixed lock manager lock ordering (bsc#1171701).

This update for libvirt fixes the following issues:

• CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).
• CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).
• qemu: Avoid stale capabilities cache host CPU or kernel command line changes (bsc#1173157).
• virdevmapper: Handle kernel without device-mapper support (bsc#1175465).
• Xen: Added support for passing arbitrary commands to the qemu device model, similar to the xl.cfg(5) device_model_args setting (bsc#1174139).
• Xen: Don't add dom0 twice on driver reload (bsc#1176430).

This update for libvirt fixes the following issues:

• CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).
• CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).
• qemu: Adjust max memlock on mdev hotplug (bsc#1177480).
• Xen: Don't add dom0 twice on driver reload (bsc#1176430).
• virdevmapper: Handle kernel without device-mapper support (bsc#1175465).
• Fixed an issue where building was failing (bsc#1175574).

This update for libvirt fixes the following issues:

• CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).
• CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).
• libxl: Fixed lock manager lock ordering (bsc#1171701).

This update for libvirt fixes the following issues:

• CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).
• CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).
• qemu: Adjust max memlock on mdev hotplug (bsc#1177480).
• Xen: Don't add dom0 twice on driver reload (bsc#1176430).
• Fixed an issue where building was failing (bsc#1175574).

This update for libvirt fixes the following issues:

CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955). CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).

This update for libvirt fixes the following issues:

• CVE-2020-15708: Added a note to libvirtd.conf about polkit auth in SUSE distros (bsc#1174955).
• CVE-2020-25637: Fixed a double free in qemuAgentGetInterfaces() (bsc#1177155).

It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvirt to stop accepting connections, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3667)

It was discovered that libvirt incorrectly handled threads during shutdown. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3975)

It was discovered that libvirt incorrectly handled the libxl driver. An attacker inside a guest could possibly use this issue to cause libvirtd to crash or stop responding, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2021-4147)

It was discovered that libvirt incorrectly handled the nwfilter driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2022-0897)

It was discovered that libvirt incorrectly handled the polkit access control driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-25637)

It was discovered that libvirt incorrectly generated SELinux labels. In environments using SELinux, this issue could allow the sVirt confinement to be bypassed. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3631)