CVE-2021-3631

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.(CVE-2021-3667)

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.(CVE-2021-3631)

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

• libvirt: Insecure sVirt label generation (CVE-2021-3631)

• libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

• libvirt: Insecure sVirt label generation (CVE-2021-3631)

• libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2021-3631: security: fix SELinux label generation logic
• CVE-2021-3667: storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath

• CVE-2021-3631: Fix insecure sVirt label generation (single-category MCS labels) in virSecuritySELinuxMCSFind()
• CVE-2021-3975: Fix use-after-free due to missing monitor lock in qemuProcessHandleMonitorEOF()
• CVE-2022-0897: Fix missing locking in nwfilterConnectNumOfNWFilters() (DoS)
• CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus()
• Fix udev device reference leak on NULL interface names in udevListInterfacesByStatus() and udevConnectListAllInterfaces()

• CVE-2021-3631: Fix insecure sVirt label generation (single-category MCS labels) in virSecuritySELinuxMCSFind()
• CVE-2021-3975: Fix use-after-free due to missing monitor lock in qemuProcessHandleMonitorEOF()
• CVE-2022-0897: Fix missing locking in nwfilterConnectNumOfNWFilters() (DoS)
• CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus()
• Fix udev device reference leak on NULL interface names in udevListInterfacesByStatus() and udevConnectListAllInterfaces()

Updated libvirt packages fix security vulnerability:

insecure sVirt label generation (CVE-2021-3631).

This update for libvirt fixes the following issues:

• CVE-2021-3631: fix SELinux label generation logic (bsc#1187871)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2021-3631: fix SELinux label generation logic (bsc#1187871)
• CVE-2021-3667: Unlock object on ACL fail in storagePoolLookupByTargetPath (bsc#1188843)

Non-security issues fixed:

• virtlockd: Don't report error if lockspace exists (bsc#1184253)
• Don't forcibly remove '--listen' arg from /etc/sysconfig/libvirtd. Add '--timeout 120' if '--listen' is not specified. (bsc#1188232)

These are all security issues fixed in the libvirt-7.7.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libvirt fixes the following issues:

• CVE-2021-3631: fix SELinux label generation logic (bsc#1187871)

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2021-3631: fix SELinux label generation logic (bsc#1187871)
• CVE-2021-3667: Unlock object on ACL fail in storagePoolLookupByTargetPath (bsc#1188843)

Non-security issues fixed:

• virtlockd: Don't report error if lockspace exists (bsc#1184253)
• Don't forcibly remove '--listen' arg from /etc/sysconfig/libvirtd. Add '--timeout 120' if '--listen' is not specified. (bsc#1188232)

It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvirt to stop accepting connections, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3667)

It was discovered that libvirt incorrectly handled threads during shutdown. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3975)

It was discovered that libvirt incorrectly handled the libxl driver. An attacker inside a guest could possibly use this issue to cause libvirtd to crash or stop responding, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2021-4147)

It was discovered that libvirt incorrectly handled the nwfilter driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2022-0897)

It was discovered that libvirt incorrectly handled the polkit access control driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-25637)

It was discovered that libvirt incorrectly generated SELinux labels. In environments using SELinux, this issue could allow the sVirt confinement to be bypassed. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3631)