CVE-2014-3657

Updated libvirt packages fix security vulnerabilities:

An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process (CVE-2014-3633).

A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive (CVE-2014-3657).

These are all security issues fixed in the libvirt-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

libvirt was updated to fix security issues and bugs.

These security issues were fixed:

• Fixed denial of service flaw in libvirt's virConnectListAllDomains() function (CVE-2014-3657).
• Information leak with flag VIR_DOMAIN_XML_MIGRATABLE (CVE-2014-7823).
• local denial of service in qemu driver (CVE-2014-8136)

These non-security issues were fixed:

• Get /proc/sys/net/ipv[46] read-write for wicked to work in containers (bsc#904432).
• libxl: Several migration improvements (bsc#903756).
• libxl: allow libxl to find pygrub binary (bdo#770485).
• Fix Qemu AppArmor abstraction (bsc#904426).
• AppArmor confined kvm domains couldn't find the apparmor profile template (bnc#902976).
• Backport commit c110cdb2 to fix non-raw storage format error (bnc#900587).
• qemu: use systemd's TerminateMachine to kill all processes (bsc#899334).
• Transformed Errors into warnings in detect_scsi_host_caps.
• Fix a missing cleanup for lxc containers.
• Adding network configuration to containers. bsc#904432

This collective update for KVM and libvirt provides fixes for security and non-security issues.

kvm:

* Fix NULL pointer dereference because of uninitialized UDP socket.
  (bsc#897654, CVE-2014-3640)
* Fix performance degradation after migration. (bsc#878350)
* Fix potential image corruption due to missing FIEMAP_FLAG_SYNC flag
  in FS_IOC_FIEMAP ioctl. (bsc#908381)
* Add validate hex properties for qdev. (bsc#852397)
* Add boot option to do strict boot (bsc#900084)
* Add query-command-line-options QMP command. (bsc#899144)
* Fix incorrect return value of migrate_cancel. (bsc#843074)
* Fix insufficient parameter validation during ram load. (bsc#905097,
  CVE-2014-7840)
* Fix insufficient blit region checks in qemu/cirrus. (bsc#907805,
  CVE-2014-8106)

libvirt:

* Fix security hole with migratable flag in dumpxml. (bsc#904176,
  CVE-2014-7823)
* Fix domain deadlock. (bsc#899484, CVE-2014-3657)
* Use correct definition when looking up disk in qemu blkiotune.
  (bsc#897783, CVE-2014-3633)
* Fix undefined symbol when starting virtlockd. (bsc#910145)
* Add '-boot strict' to qemu's commandline whenever possible.
  (bsc#900084)
* Add support for 'reboot-timeout' in qemu. (bsc#899144)
* Increase QEMU's monitor timeout to 30sec. (bsc#911742)
* Allow setting QEMU's migration max downtime any time. (bsc#879665)

Security Issues:

* CVE-2014-7823
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7823>
* CVE-2014-3657
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3657>
* CVE-2014-3633
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3633>
* CVE-2014-3640
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3640>
* CVE-2014-7840
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7840>
* CVE-2014-8106
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8106>

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

Pavel Hrdina discovered that libvirt incorrectly handled locking when processing the virConnectListAllDomains command. An attacker could use this issue to cause libvirtd to hang, resulting in a denial of service. (CVE-2014-3657)

Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file. (CVE-2014-7823)