util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.(CVE-2018-6764)

According to the versions of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

  - qemu/qemu_monitor.c in libvirt allows attackers to     cause a denial of service (memory consumption) via a     large QEMU reply.(CVE-2018-5748)

  - libvirt version 2.3.0 and later is vulnerable to a bad     default configuration of 'verify-peer=no' passed to     QEMU by libvirt resulting in a failure to validate     SSL/TLS certificates by default.(CVE-2017-1000256)

  - An incomplete fix for CVE-2018-5748 that affects QEMU     monitor leading to a resource exhaustion but now also     triggered via QEMU guest agent.(CVE-2018-1064)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles     the holding of a monitor job during a query to a guest     agent, which allows attackers to cause a denial of     service (API blockage).(CVE-2019-20485)

  - It was discovered that libvirtd before versions 4.10.1     and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an     arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with     access to the libvirtd socket could use this to probe     the existence of arbitrary files, cause denial of     service or cause libvirtd to execute arbitrary     programs.(CVE-2019-10161)

  - The virConnectGetDomainCapabilities() libvirt API,     versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1,     accepts an 'emulatorbin' argument to specify the     program providing emulation for a domain. Since     v1.2.19, libvirt will execute that program to probe the     domain's capabilities. Read-only clients could specify     an arbitrary path for this argument, causing libvirtd     to execute a crafted executable with its own     privileges.(CVE-2019-10167)

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues: Security issues fixed :

  - CVE-2017-5715: Fixes for speculative side channel     attacks aka 'SpectreAttack' (var2) (bsc#1079869).

  - CVE-2018-6764: Fixed guest executable code injection via     libnss_dns.so loaded by libvirt_lxc before init     (bsc#1080042).

  - CVE-2018-1064: Fixed denial of service when reading from     guest agent (bsc#1083625). Non-security issues fixed :

  - Error starting domain: internal error: No usable sysfs     TPM cancel file could be found (bsc#1078808).

  - SUSE Linux Enterprise 11 SP4 hvm converted to pvhvm.
    Unless vm memory is on gig boundary, vm won't boot     (bsc#1082041).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-3113 advisory.

    [4.5.0-10]
    - conf: correct false boot order error during domain parse (rhbz#1601318)

    [4.5.0-9]
    - virDomainDefCompatibleDevice: Relax alias change check (rhbz#1621910)
    - virDomainDetachDeviceFlags: Clarify update semantics (rhbz#1621910)
    - virDomainNetDefCheckABIStability: Check for MTU change too (rhbz#1623157)

    [4.5.0-8]
    - storage: Add --shrink to qemu-img command when shrinking vol (rhbz#1613746)
    - access: Fix nwfilter-binding ACL access API name generation (rhbz#1611320)
    - qemu: mdev: Use vfio-pci 'display' property only with vfio-pci mdevs (rhbz#1624735)

    [4.5.0-7]
    - qemu_migration: Avoid writing to freed memory (rhbz#1593137)
    - qemu: hotplug: Fix asynchronous unplug of 'shmem' (rhbz#1618622)
    - tests: rename hugepages to hugepages-default (rhbz#1591235)
    - tests: extract hugepages-numa-default-dimm out of hugepages-numa (rhbz#1591235)
    - tests: rename hugepages-numa into hugepages-numa-default (rhbz#1591235)
    - tests: remove unnecessary XML elements from hugepages-numa-default (rhbz#1591235)
    - tests: extract pages-discard out of hugepages-pages (rhbz#1591235)
    - tests: rename hugepages-pages into hugepages-numa-nodeset (rhbz#1591235)
    - tests: rename hugepages-pages2 into hugepages-numa-default-2M (rhbz#1591235)
    - tests: extract pages-discard-hugepages out of hugepages-pages3 (rhbz#1591235)
    - tests: rename hugepages-pages3 into hugepages-numa-nodeset-part (rhbz#1591235)
    - tests: rename hugepages-pages4 into hugepages-numa-nodeset-nonexist (rhbz#1591235)
    - tests: rename hugepages-pages5 into hugepages-default-2M (rhbz#1591235)
    - tests: rename hugepages-pages6 into hugepages-default-system-size (rhbz#1591235)
    - tests: rename hugepages-pages7 into pages-dimm-discard (rhbz#1591235)
    - tests: rename hugepages-pages8 into hugepages-nodeset-nonexist (rhbz#1591235)
    - tests: introduce hugepages-default-1G-nodeset-2M (rhbz#1591235)
    - tests: introduce hugepages-nodeset (rhbz#1591235)
    - conf: Move hugepage XML validation check out of qemu_command (rhbz#1591235)
    - conf: Move hugepages validation out of XML parser (rhbz#1591235)
    - conf: Introduce virDomainDefPostParseMemtune (rhbz#1591235)
    - tests: sev: Test launch-security with specific QEMU version (rhbz#1612009)
    - qemu: Fix probing of AMD SEV support (rhbz#1612009)
    - qemu: caps: Format SEV platform data into qemuCaps cache (rhbz#1612009)

    [4.5.0-6]
    - qemu: Exempt video model 'none' from getting a PCI address on Q35 (rhbz#1609087)
    - conf: Fix a error msg typo in virDomainVideoDefValidate (rhbz#1607825)

    [4.5.0-5]
    - esx storage: Fix typo lsilogic -> lsiLogic (rhbz#1571759)
    - networkGetDHCPLeases: Dont always report error if unable to read leases file (rhbz#1600468)
    - nwfilter: Resolve SEGV for NWFilter Snoop processing (rhbz#1599973)
    - qemu: Remove unused bypassSecurityDriver from qemuOpenFileAs (rhbz#1589115)
    - qemuDomainSaveMemory: Dont enforce dynamicOwnership (rhbz#1589115)
    - domain_nwfilter: Return early if net has no name in virDomainConfNWFilterTeardownImpl (rhbz#1607831)
    - examples: Add clean-traffic-gateway into nwfilters (rhbz#1603115)

    [4.5.0-4]
    - qemu: hotplug: dont overwrite error message in qemuDomainAttachNetDevice (rhbz#1598311)
    - qemu: hotplug: report error when changing rom enabled attr for net iface (rhbz#1599513)
    - qemu: Fix setting global_period cputune element (rhbz#1600427)
    - tests: qemucaps: Add test data for upcoming qemu 3.0.0 (rhbz#1475770)
    - qemu: capabilities: Add capability for werror/rerror for 'usb-device' frontend (rhbz#1475770)
    - qemu: command: Move graphics iteration to its own function (rhbz#1475770)
    - qemu: address: Handle all the video devices within a single loop (rhbz#1475770)
    - conf: Introduce virDomainVideoDefClear helper (rhbz#1475770)
    - conf: Introduce virDomainDefPostParseVideo helper (rhbz#1475770)
    - qemu: validate: Enforce compile time switch type checking for videos (rhbz#1475770)
    - tests: Add capabilities data for QEMU 2.11 x86_64 (rhbz#1475770)
    - tests: Update capabilities data for QEMU 3.0.0 x86_64 (rhbz#1475770)
    - qemu: qemuBuildHostdevCommandLine: Use a helper variable mdevsrc (rhbz#1475770)
    - qemu: caps: Introduce a capability for egl-headless (rhbz#1475770)
    - qemu: Introduce a new graphics display type 'headless' (rhbz#1475770)
    - qemu: caps: Add vfio-pci.display capability (rhbz#1475770)
    - conf: Introduce virDomainGraphicsDefHasOpenGL helper (rhbz#1475770)
    - conf: Replace 'error' with 'cleanup' in virDomainHostdevDefParseXMLSubsys (rhbz#1475770)
    - conf: Introduce new <hostdev> attribute 'display' (rhbz#1475770)
    - qemu: command: Enable formatting vfio-pci.display option onto cmdline (rhbz#1475770)
    - docs: Rephrase the mediated devices hostdev section a bit (rhbz#1475770)
    - conf: Introduce new video type 'none' (rhbz#1475770)
    - virt-xml-validate: Add schema for nwfilterbinding (rhbz#1600330)
    - tools: Fix typo generating adapter_wwpn field (rhbz#1601377)
    - src: Fix memory leak in virNWFilterBindingDispose (rhbz#1603025)

    [4.5.0-3]
    - qemu: hotplug: Do not try to add secret object for TLS if it does not exist (rhbz#1598015)
    - qemu: monitor: Make qemuMonitorAddObject more robust against programming errors (rhbz#1598015)
    - spec: Explicitly require matching libvirt-libs (rhbz#1600122)
    - virDomainConfNWFilterInstantiate: initialize @xml to avoid random crash (rhbz#1599545)
    - qemuProcessStartPRDaemonHook: Try to set NS iff domain was started with one (rhbz#1470007)
    - qemuDomainValidateStorageSource: Relax PR validation (rhbz#1470007)
    - virStoragePRDefFormat: Suppress path formatting for migratable XML (rhbz#1470007)
    - qemu: Wire up PR_MANAGER_STATUS_CHANGED event (rhbz#1470007)
    - qemu_monitor: Introduce qemuMonitorJSONGetPRManagerInfo (rhbz#1470007)
    - qemu: Fetch pr-helper process info on reconnect (rhbz#1470007)
    - qemu: Fix ATTRIBUTE_NONNULL for qemuMonitorAddObject (rhbz#1598015)
    - virsh.pod: Fix a command name typo in nwfilter-binding-undefine (rhbz#1600329)
    - docs: schema: Add missing <alias> to vsock device (rhbz#1600345)
    - virnetdevtap: Dont crash on !ifname in virNetDevTapInterfaceStats (rhbz#1595184)

    [4.5.0-2]
    - qemu: Add capability for the HTM pSeries feature (rhbz#1525599)
    - conf: Parse and format the HTM pSeries feature (rhbz#1525599)
    - qemu: Format the HTM pSeries feature (rhbz#1525599)
    - qemu: hotplug: Dont access srcPriv when its not allocated (rhbz#1597550)
    - qemuDomainNestedJobAllowed: Allow QEMU_JOB_NONE (rhbz#1598084)
    - src: Mention DEVICE_REMOVAL_FAILED event in virDomainDetachDeviceAlias docs (rhbz#1598087)
    - virsh.pod: Drop --persistent for detach-device-alias (rhbz#1598087)
    - qemu: dont use chardev FD passing with standalone args (rhbz#1598281)
    - qemu: remove chardevStdioLogd param from vhostuser code path (rhbz#1597940)
    - qemu: consolidate parameters of qemuBuildChrChardevStr into flags (rhbz#1597940)
    - qemu: dont use chardev FD passing for vhostuser backend (rhbz#1597940)
    - qemu: fix UNIX socket chardevs operating in client mode (rhbz#1598440)
    - qemuDomainDeviceDefValidateNetwork: Check for range only if IP prefix set (rhbz#1515533)

    [4.5.0-1]
    - Rebased to libvirt-4.5.0 (rhbz#1563169)
    - The rebase also fixes the following bugs:
        rhbz#1291851, rhbz#1393106, rhbz#1468422, rhbz#1469338, rhbz#1526382         rhbz#1529059, rhbz#1541921, rhbz#1544869, rhbz#1552092, rhbz#1568407         rhbz#1583623, rhbz#1584091, rhbz#1585108, rhbz#1586027, rhbz#1588295         rhbz#1588336, rhbz#1589730, rhbz#1590214, rhbz#1591017, rhbz#1591561         rhbz#1591628, rhbz#1591645, rhbz#1593549

    [4.4.0-2]
    - build: Dont install sysconfig files as scripts (rhbz#1563169)

    [4.4.0-1]
    - Rebased to libvirt-4.4.0 (rhbz#1563169)
    - The rebase also fixes the following bugs:
        rhbz#1149445, rhbz#1291851, rhbz#1300772, rhbz#1400475, rhbz#1456165         rhbz#1470007, rhbz#1480668, rhbz#1534418, rhbz#1549531, rhbz#1559284         rhbz#1559835, rhbz#1560946, rhbz#1566416, rhbz#1569861, rhbz#1572491         rhbz#1574089, rhbz#1576916, rhbz#1583484, rhbz#1583927, rhbz#1584071         rhbz#1584073

    [4.3.0-1]
    - Rebased to libvirt-4.3.0 (rhbz#1563169)
    - The rebase also fixes the following bugs:
        rhbz#1509870, rhbz#1530451, rhbz#1577920, rhbz#1283700, rhbz#1425757         rhbz#1448149, rhbz#1454709, rhbz#1502754, rhbz#1507737, rhbz#1519130         rhbz#1519146, rhbz#1522706, rhbz#1523564, rhbz#1524399, rhbz#1525496         rhbz#1527740, rhbz#1550980, rhbz#916061, rhbz#1494454, rhbz#1515533         rhbz#1532542, rhbz#1538570, rhbz#1544325, rhbz#1544659, rhbz#1546971         rhbz#1347550, rhbz#1367238, rhbz#1483816, rhbz#1543775, rhbz#1551000         rhbz#1552127, rhbz#1553075, rhbz#1553085, rhbz#1554876, rhbz#1556828         rhbz#1558317, rhbz#1425058, rhbz#1490158, rhbz#1492597, rhbz#1520821         rhbz#1529256, rhbz#1547250, rhbz#1557769, rhbz#1560917, rhbz#1560976         rhbz#1568148, rhbz#1569678, rhbz#1576464

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libvirt: guest could inject executable code via     libnss_dns.so loaded by libvirt_lxc before init     (CVE-2018-6764)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
119788	Amazon Linux 2 : libvirt (ALAS-2018-1134)	Nessus	Amazon Linux Local Security Checks	2018/12/20	2024/7/15	high
124897	EulerOS Virtualization for ARM 64 3.0.1.0 : libvirt (EulerOS-SA-2019-1394)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	high
141658	EulerOS Virtualization 3.0.2.2 : libvirt (EulerOS-SA-2020-2209)	Nessus	Huawei Local Security Checks	2020/10/21	2024/2/14	high
108827	SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:0861-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/4/4	2024/11/21	high
118773	Oracle Linux 7 : libvirt (ELSA-2018-3113)	Nessus	Oracle Linux Local Security Checks	2018/11/7	2024/11/1	high
119193	Scientific Linux Security Update : libvirt on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	2018/11/27	2024/7/18	high

检测

插件搜索

high

high

high

high

high

high