Поиск уязвимостей

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.

Libvirt: stack use-after-free in virnetclientioeventloop()

A race condition leading to a stack use-after-free flaw was found in l ...

Множественные уязвимости libvirt

Moderate: libvirt security update

A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.

ELSA-2024-9128: libvirt security update (MODERATE)

Уязвимость библиотеки управления виртуализацией Libvirt, связанная с разыменованием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании

Security update for libvirt

Low: virt:rhel and virt-devel:rhel security and bug fix update

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.

ELSA-2024-4757: libvirt security update (MODERATE)

ELSA-2024-4351: virt:ol and virt-devel:ol security and bug fix update (MODERATE)

ELSA-2024-12673: libvirt security update (IMPORTANT)

Уязвимость метода virNetClientIOEventLoop() библиотеки управления виртуализацией Libvirt, позволяющая нарушителю получить несанкционированный доступ к virtproxyd без аутентификации

Уязвимость libvirt

Уязвимость libvirt

ELSA-2024-12604: virt:kvm_utils3 security update (IMPORTANT)

ELSA-2024-12605: virt:kvm_utils2 security update (IMPORTANT)