CVE-2020-10703

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: hivex (1.3.18), libguestfs (1.40.2), libguestfs-winsupport (8.2), libvirt (6.0.0), libvirt-dbus (1.3.0), libvirt-python (6.0.0), nbdkit (1.16.2), perl-Sys-Virt (6.0.0), qemu-kvm (4.2.0), seabios (1.13.0), SLOF (20191022). (BZ#1810193, BZ#1844296)

Security Fix(es):

• libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

• QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

• libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

• QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

• libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

• libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: hivex (1.3.18), libguestfs (1.40.2), libguestfs-winsupport (8.2), libvirt (6.0.0), libvirt-dbus (1.3.0), libvirt-python (6.0.0), nbdkit (1.16.2), perl-Sys-Virt (6.0.0), qemu-kvm (4.2.0), seabios (1.13.0), SLOF (20191022). (BZ#1810193, BZ#1844296)

Security Fix(es):

• libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

• QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

• libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

• QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

• libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

• libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Updated libvirt packages fix security vulnerability:

It was discovered that libvirt incorrectly handled an active pool without a target path. A remote attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service (CVE-2020-10703).

It was discovered that libvirt incorrectly handled memory when retrieving certain domain statistics. A remote attacker could possibly use this issue to cause libvirt to consume resources, resulting in a denial of service (CVE-2020-12430).

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2020-10703: Fixed a daemon crash caused by pools without target paths (bsc#1168683).
• CVE-2020-12430: Fixed a memory leak in qemuDomainGetStatsIOThread (bsc#1170765).

Non-security issues fixed:

• Support setting credit2 scheduler parameters for xen (bsc#1162160).
• Add SLE 15 and SLE 12 service packs support to 'libvirtd' (bsc#1154093).
• Add support boot from 'vfio-ccw'and 'mdev' devices (jsc#SLE-5826, FATE#327355, bsc#1152649).
• Fix lock manager lock ordering (bsc#1145774).
• Do not define known no-op features. (bsc#1151850).
• Enable use of newer libxl APIs for retrieving memory statistics (bsc#1157490, bsc#1167007).
• Create multipath targets for qemu PR (bsc#1161883).

This update for libvirt fixes the following issues:

Security issue fixed:

• CVE-2020-10703: Fixed a daemon crash caused by pools without target paths (bsc#1168683).

Non-security issues fixed:

• apparmor: avoid copying empty profile name (bsc#1149100).
• logging: ensure virtlogd rollover takes priority over logrotate (bsc#1137137).
• qemu: Add support for overriding max threads per process limit (bsc#1133719).
• util: fix copying bitmap to larger data buffer (bsc#1138734).
• virsh: support for setting precopy bandwidth in migrate (bsc#1145586).
• virsh: use upstream name for migration precopy bandwidth parameter (bsc#1145586).

This update for libvirt fixes the following issues:

Security issues fixed:

• CVE-2020-10703: Fixed a daemon crash caused by pools without target paths (bsc#1168683).
• CVE-2020-12430: Fixed a memory leak in qemuDomainGetStatsIOThread (bsc#1170765).

Non-security issues fixed:

• Support setting credit2 scheduler parameters for xen (bsc#1162160).
• Enable use of newer libxl APIs for retrieving memory statistics (bsc#1157490, bsc#1167007).
• Create multipath targets for qemu PR (bsc#1161883).

This update for libvirt fixes the following issues:

Security issue fixed:

• CVE-2020-10703: Fixed a daemon crash caused by pools without target paths (bsc#1168683).

Non-security issues fixed:

• apparmor: avoid copying empty profile name (bsc#1149100).
• logging: ensure virtlogd rollover takes priority over logrotate (bsc#1137137).
• qemu: Add support for overriding max threads per process limit (bsc#1133719).
• util: fix copying bitmap to larger data buffer (bsc#1138734).
• virsh: support for setting precopy bandwidth in migrate (bsc#1145586).
• virsh: use upstream name for migration precopy bandwidth parameter (bsc#1145586).
• virt-create-rootfs: add SLE 15 and SLE 12 service packs support (bsc#1154093).

It was discovered that libvirt incorrectly handled an active pool without a target path. A remote attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2020-10703)

It was discovered that libvirt incorrectly handled memory when retrieving certain domain statistics. A remote attacker could possibly use this issue to cause libvirt to consume resources, resulting in a denial of service. This issue only affected Ubuntu 19.10. (CVE-2020-12430)