来自 Red Hat 安全公告 2019:1264： libvirt 的更新现在可用于 Red Hat Enterprise Linux 7。 Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。 libvirt 库包括一款 C API，用于管理并交互 Linux 和其他操作系统的虚拟化功能。 此外，libvirt 还提供用于远程管理虚拟化系统的工具。 安全补丁： * libvirt：由于缺少 SocketMode 参数，systemd admin-sock 中错误的权限 (CVE-2019-10132) 有关此安全问题的详细信息，包括其影响、CVSS 分数、致谢和其他相关信息，请参阅列于“参考”部分的 CVE 页面。 缺陷补丁： * 由于无效指针错误尝试释放 virNWFilterBindingDefFree() 中的内存，造成 libvirt 中断并使用 SIGABRT 核心转储 (BZ# 1702173)

远程 Oracle Linux 7 主机上安装的多个程序包受到 ELSA-2019-4687 公告中提及的一个漏洞影响。

  - 在 virtlockd-admin.socket 和 virtlogd-admin.socket systemd 单元的 libvirt >= 4.1.0 中发现了一个漏洞。缺失的 SocketMode 配置参数允许主机上的任何用户使用 virtlockd-admin-sock 或 virtlogd-admin-sock 进行连接，以及对 virtlockd 和 virtlogd 后台程序执行管理任务。(CVE-2019-10132)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4687 advisory.

    - logging: restrict sockets to mode 0600 (Daniel P. Berrange)  [Orabug: 29861433]  {CVE-2019-10132}
    - locking: restrict sockets to mode 0600 (Daniel P. Berrange)  [Orabug: 29861433]  {CVE-2019-10132}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1268 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1264 advisory.

    - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
    - locking: restrict sockets to mode 0600 (CVE-2019-10132)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libvirt fixes the following issues :

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

These updates contain the libvirt adjustments, that pass through the new 'md-clear' CPU flag (bsc#1135273).

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

Security issues fixed: CVE-2019-10132: Reject clients unless their UID matches the server UID (bsc#1134348)

Non security issues fixed: delay global firewall setup if no networks are running (bsc#1133229)

add systemd-container dependency to qemu and lxc drivers (bsc#1136109)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
125442	Oracle Linux 7 : libvirt (ELSA-2019-1264)	Nessus	Oracle Linux Local Security Checks	2019/5/28	2024/11/1	high
180738	Oracle Linux 7：libvirt (ELSA-2019-4687)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	high
180738	Oracle Linux 7 : libvirt (ELSA-2019-4687)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	high
125384	RHEL 8 : virt:rhel (RHSA-2019:1268)	Nessus	Red Hat Local Security Checks	2019/5/24	2024/11/6	high
125442	Oracle Linux 7 : libvirt (ELSA-2019-1264)	Nessus	Oracle Linux Local Security Checks	2019/5/28	2024/11/1	high
125922	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2019:1490-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	2019/6/14	2024/5/27	high

检测

插件搜索

high

high

high

high

high

high