Описание
Security update for libvirt
This update for libvirt fixes the following issues:
- CVE-2026-18917: integer overflow in
NodeGetFreePagesRPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863). - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for
dnsmasqconfiguration directive injection and can lead to arbitrary code execution as root (bsc#1274576). - CVE-2026-63622: symlink-following in
virFileChownFiles()allowsswtpmuser to trick the root-levellibvirtdaemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264). - CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265).
- CVE-2026-77159: root
chown()onswtpmlogfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1274576
- SUSE Bug 1274946
- SUSE Bug 1275264
- SUSE Bug 1275265
- SUSE Bug 1275863
- SUSE CVE CVE-2026-18917 page
- SUSE CVE CVE-2026-61477 page
- SUSE CVE CVE-2026-63622 page
- SUSE CVE CVE-2026-63623 page
- SUSE CVE CVE-2026-77159 page
Описание
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
Затронутые продукты
Ссылки
- CVE-2026-18917
- SUSE Bug 1275863
Описание
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
Затронутые продукты
Ссылки
- CVE-2026-61477
- SUSE Bug 1274576
Описание
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
Затронутые продукты
Ссылки
- CVE-2026-63622
- SUSE Bug 1275264
Описание
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
Затронутые продукты
Ссылки
- CVE-2026-63623
- SUSE Bug 1275265
Описание
unknown
Затронутые продукты
Ссылки
- CVE-2026-77159
- SUSE Bug 1274946