Описание
Security update for libvirt
This update for libvirt fixes the following issues:
- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).
- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection (bsc#1274576).
- CVE-2026-63622:
swtpmprivilege escalation via symlink following (bsc#1275264). - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).
- CVE-2026-77159: root
chown()onswtpmlogfile follows symlinks (bsc#1274946).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
libvirt-9.0.0-150500.6.29.1
libvirt-client-9.0.0-150500.6.29.1
libvirt-client-qemu-9.0.0-150500.6.29.1
libvirt-daemon-9.0.0-150500.6.29.1
libvirt-daemon-config-network-9.0.0-150500.6.29.1
libvirt-daemon-config-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-interface-9.0.0-150500.6.29.1
libvirt-daemon-driver-libxl-9.0.0-150500.6.29.1
libvirt-daemon-driver-network-9.0.0-150500.6.29.1
libvirt-daemon-driver-nodedev-9.0.0-150500.6.29.1
libvirt-daemon-driver-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-qemu-9.0.0-150500.6.29.1
libvirt-daemon-driver-secret-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-core-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-disk-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-direct-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-logical-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-mpath-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-rbd-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-scsi-9.0.0-150500.6.29.1
libvirt-daemon-hooks-9.0.0-150500.6.29.1
libvirt-daemon-qemu-9.0.0-150500.6.29.1
libvirt-daemon-xen-9.0.0-150500.6.29.1
libvirt-devel-9.0.0-150500.6.29.1
libvirt-doc-9.0.0-150500.6.29.1
libvirt-libs-9.0.0-150500.6.29.1
libvirt-lock-sanlock-9.0.0-150500.6.29.1
libvirt-nss-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
libvirt-9.0.0-150500.6.29.1
libvirt-client-9.0.0-150500.6.29.1
libvirt-client-qemu-9.0.0-150500.6.29.1
libvirt-daemon-9.0.0-150500.6.29.1
libvirt-daemon-config-network-9.0.0-150500.6.29.1
libvirt-daemon-config-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-interface-9.0.0-150500.6.29.1
libvirt-daemon-driver-libxl-9.0.0-150500.6.29.1
libvirt-daemon-driver-network-9.0.0-150500.6.29.1
libvirt-daemon-driver-nodedev-9.0.0-150500.6.29.1
libvirt-daemon-driver-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-qemu-9.0.0-150500.6.29.1
libvirt-daemon-driver-secret-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-core-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-disk-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-direct-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-logical-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-mpath-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-rbd-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-scsi-9.0.0-150500.6.29.1
libvirt-daemon-hooks-9.0.0-150500.6.29.1
libvirt-daemon-qemu-9.0.0-150500.6.29.1
libvirt-daemon-xen-9.0.0-150500.6.29.1
libvirt-devel-9.0.0-150500.6.29.1
libvirt-doc-9.0.0-150500.6.29.1
libvirt-libs-9.0.0-150500.6.29.1
libvirt-lock-sanlock-9.0.0-150500.6.29.1
libvirt-nss-9.0.0-150500.6.29.1
SUSE Linux Enterprise Micro 5.5
libvirt-client-9.0.0-150500.6.29.1
libvirt-daemon-9.0.0-150500.6.29.1
libvirt-daemon-driver-interface-9.0.0-150500.6.29.1
libvirt-daemon-driver-network-9.0.0-150500.6.29.1
libvirt-daemon-driver-nodedev-9.0.0-150500.6.29.1
libvirt-daemon-driver-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-qemu-9.0.0-150500.6.29.1
libvirt-daemon-driver-secret-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-core-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-disk-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-direct-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-logical-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-mpath-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-rbd-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-scsi-9.0.0-150500.6.29.1
libvirt-daemon-qemu-9.0.0-150500.6.29.1
libvirt-libs-9.0.0-150500.6.29.1
SUSE Linux Enterprise Server 15 SP5-LTSS
libvirt-9.0.0-150500.6.29.1
libvirt-client-9.0.0-150500.6.29.1
libvirt-client-qemu-9.0.0-150500.6.29.1
libvirt-daemon-9.0.0-150500.6.29.1
libvirt-daemon-config-network-9.0.0-150500.6.29.1
libvirt-daemon-config-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-interface-9.0.0-150500.6.29.1
libvirt-daemon-driver-libxl-9.0.0-150500.6.29.1
libvirt-daemon-driver-network-9.0.0-150500.6.29.1
libvirt-daemon-driver-nodedev-9.0.0-150500.6.29.1
libvirt-daemon-driver-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-qemu-9.0.0-150500.6.29.1
libvirt-daemon-driver-secret-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-core-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-disk-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-direct-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-logical-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-mpath-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-rbd-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-scsi-9.0.0-150500.6.29.1
libvirt-daemon-hooks-9.0.0-150500.6.29.1
libvirt-daemon-qemu-9.0.0-150500.6.29.1
libvirt-daemon-xen-9.0.0-150500.6.29.1
libvirt-devel-9.0.0-150500.6.29.1
libvirt-doc-9.0.0-150500.6.29.1
libvirt-libs-9.0.0-150500.6.29.1
libvirt-lock-sanlock-9.0.0-150500.6.29.1
libvirt-nss-9.0.0-150500.6.29.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
libvirt-9.0.0-150500.6.29.1
libvirt-client-9.0.0-150500.6.29.1
libvirt-client-qemu-9.0.0-150500.6.29.1
libvirt-daemon-9.0.0-150500.6.29.1
libvirt-daemon-config-network-9.0.0-150500.6.29.1
libvirt-daemon-config-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-interface-9.0.0-150500.6.29.1
libvirt-daemon-driver-libxl-9.0.0-150500.6.29.1
libvirt-daemon-driver-network-9.0.0-150500.6.29.1
libvirt-daemon-driver-nodedev-9.0.0-150500.6.29.1
libvirt-daemon-driver-nwfilter-9.0.0-150500.6.29.1
libvirt-daemon-driver-qemu-9.0.0-150500.6.29.1
libvirt-daemon-driver-secret-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-core-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-disk-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-iscsi-direct-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-logical-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-mpath-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-rbd-9.0.0-150500.6.29.1
libvirt-daemon-driver-storage-scsi-9.0.0-150500.6.29.1
libvirt-daemon-hooks-9.0.0-150500.6.29.1
libvirt-daemon-qemu-9.0.0-150500.6.29.1
libvirt-daemon-xen-9.0.0-150500.6.29.1
libvirt-devel-9.0.0-150500.6.29.1
libvirt-doc-9.0.0-150500.6.29.1
libvirt-libs-9.0.0-150500.6.29.1
libvirt-lock-sanlock-9.0.0-150500.6.29.1
libvirt-nss-9.0.0-150500.6.29.1
Ссылки
- Link for SUSE-SU-2026:4009-1
- E-Mail link for SUSE-SU-2026:4009-1
- SUSE Security Ratings
- SUSE Bug 1274576
- SUSE Bug 1274946
- SUSE Bug 1275264
- SUSE Bug 1275265
- SUSE Bug 1275863
- SUSE CVE CVE-2026-18917 page
- SUSE CVE CVE-2026-61477 page
- SUSE CVE CVE-2026-63622 page
- SUSE CVE CVE-2026-63623 page
- SUSE CVE CVE-2026-77159 page
Описание
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-qemu-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-daemon-9.0.0-150500.6.29.1
Ссылки
- CVE-2026-18917
- SUSE Bug 1275863
Описание
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-qemu-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-daemon-9.0.0-150500.6.29.1
Ссылки
- CVE-2026-61477
- SUSE Bug 1274576
Описание
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-qemu-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-daemon-9.0.0-150500.6.29.1
Ссылки
- CVE-2026-63622
- SUSE Bug 1275264
Описание
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-qemu-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-daemon-9.0.0-150500.6.29.1
Ссылки
- CVE-2026-63623
- SUSE Bug 1275265
Описание
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-client-qemu-9.0.0-150500.6.29.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:libvirt-daemon-9.0.0-150500.6.29.1
Ссылки
- CVE-2026-77159
- SUSE Bug 1274946