CVE-2018-1064

libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.

libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.

Updated libvirt package fixes security vulnerability:

It was discovered that libvirt had a potential denial of service reading from QEMU guest agent (CVE-2018-1064).

These are all security issues fixed in the libvirt-7.7.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2017-5715: Fixes for speculative side channel attacks aka 'SpectreAttack' (var2) (bsc#1079869).
• CVE-2018-1064: Fixed denial of service when reading from guest agent (bsc#1083625).
• CVE-2018-5748: Fixed possible denial of service when reading from QEMU monitor (bsc#1076500).

Non-security issues fixed:

• bsc#1083061: Fixed 'dumpxml --migratable' exports domain id in output on SLES11 SP4.
• bsc#1055365: Improve performance when listing hundreds of interfaces.

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2017-5715: Fixes for speculative side channel attacks aka 'SpectreAttack' (var2) (bsc#1079869).
• CVE-2018-6764: Fixed guest executable code injection via libnss_dns.so loaded by libvirt_lxc before init (bsc#1080042).
• CVE-2018-1064: Fixed denial of service when reading from guest agent (bsc#1083625).

Non-security issues fixed:

• Error starting domain: internal error: No usable sysfs TPM cancel file could be found (bsc#1078808).
• SUSE Linux Enterprise 11 SP4 hvm converted to pvhvm. Unless vm memory is on gig boundary, vm won't boot (bsc#1082041).

This update for libvirt and virt-manager fixes the following issues:

Security issues fixed:

• CVE-2017-5715: Fixes for speculative side channel attacks aka 'SpectreAttack' (var2) (bsc#1079869).
• CVE-2018-6764: Fixed guest executable code injection via libnss_dns.so loaded by libvirt_lxc before init (bsc#1080042).
• CVE-2018-1064: Fixed denial of service when reading from guest agent (bsc#1083625).

Non-security issues fixed in libvirt:

• bsc#1070615: Fixed TPM device passthrough failure on kernels >= 4.0.
• bsc#1082041: SUSE Linux Enterprise 11 SP4 hvm converted to pvhvm. Unless vm memory is on gig boundary, vm won't boot.
• bsc#1082161: Unable to change RTC basis or adjustment for Xen HVM guests using libvirt.

Non-security issues fixed in virt-manager:

• bsc#1086038: VM guests cannot be properly installed with virt-install
• bsc#1067018: KVM Guest creation failed - Property .cmt not found
• bsc#1054986: Fix openSUSE 15.0 detection. It has no content file or .treeinfo file
• bsc#1085757: Fallback to latest version of openSUSE when opensuse-unknown is detected for the ISO

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2017-5715: Spectre fixes for libvirt (bsc#1079869, bsc#1088147, bsc#1087887).
• CVE-2018-1064: Avoid denial of service reading from QEMU guest agent (bsc#1083625).
• CVE-2018-5748: Avoid denial of service reading from QEMU monitor (bsc#1076500).

Bug fixes:

• bsc#1025340: Use xend for nodeGetFreeMemory API.
• bsc#960742: Allow read access to script directories in libvirtd AppArmor profile.
• bsc#936233: Introduce qemuDomainDefCheckABIStability.

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2017-5715: Fixes for speculative side channel attacks aka 'SpectreAttack' (var2) (bsc#1079869).
• CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' (bsc#1092885).
• CVE-2018-1064: Fix denial of service problem during reading from guest agent (bsc#1083625).
• CVE-2018-5748: Fix resource exhaustion via qemuMonitorIORead() method (bsc#1076500).

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2018-3639: Add support for 'ssbd' and 'virt-ssbd' CPUID feature bits to address V4 Speculative Store Bypass aka 'Memory Disambiguation' (bsc#1092885).
• CVE-2018-1064: Fix denial of service problem during reading from guest agent (bsc#1083625).
• CVE-2018-5748: Fix resource exhaustion via qemuMonitorIORead() method (bsc#1076500).
• CVE-2016-5008: Fix that an empty VNC password disables authentication (bsc#987527).
• CVE-2017-5715: Fix speculative side channel attacks aka 'SpectreAttack' (var2) (bsc#1079869).

Bug fixes:

• bsc#980558: Fix NUMA node memory allocation.
• bsc#968483: Restart daemons in %posttrans after connection drivers.
• bsc#897352: Systemd fails to ignore LSB services.
• bsc#956298: virsh domxml-to-native causes segfault of libvirtd.
• bsc#964465: libvirtd.service causes systemd warning about xencommons service.
• bsc#954872: Script block-dmmd not working as expected.
• bsc#854343: libvirt installation run inappropriate systemd restart.

Ken Johnson and Jann Horn independently discovered that microprocessors utilizing speculative execution of a memory read may allow unauthorized memory reads via sidechannel attacks. An attacker in the guest could use this to expose sensitive guest information, including kernel memory. This update allows libvirt to expose new CPU features added by microcode updates to guests. (CVE-2018-3639)

Daniel P. Berrange discovered that libvirt incorrectly handled the QEMU guest agent. An attacker could possibly use this issue to consume resources, leading to a denial of service. (CVE-2018-1064)