Critical File Descriptor Leak in libvirt Allows Privileged Operations by Malicious Guests
Summary
ALPINE-CVE-2020-14339: A flaw was found in libvirt, where it leaked a file descriptor for /dev/mapper/control into the QEMU process. Affects libvirt versions < 6.6.0-r0. Fixed in 6.6.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libvirt is an open-source API, daemon, and management tool for managing platform virtualization. It provides a consistent way to manage virtual machines and their resources across different hypervisors. The package is widely used in cloud computing and virtualization environments. However, it has been found vulnerable to a file descriptor leak that can allow malicious users to perform unauthorized operations.
Vulnerability Detail
A flaw was discovered in libvirt that leaks a file descriptor for '/dev/mapper/control' into the QEMU process. This leak permits privileged operations against the device-mapper on the host system. As a result, a malicious guest user or process could exploit this vulnerability to perform actions outside their standard permissions, potentially leading to severe consequences for the host operating system, including breaches of confidentiality, integrity, and availability. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
6.6.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the QEMU process or isolating virtual machines to limit exposure to potential attacks. However, this is not a permanent solution and should not replace applying the patch.
Conclusion
The vulnerability in libvirt poses a significant risk by allowing unauthorized operations through a file descriptor leak. It is crucial to update to the patched version 6.6.0-r0 to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your systems.
See every vulnerability recorded for libvirt →
FAQ
The vulnerability allows malicious guest users to perform unauthorized operations on the host system, potentially compromising its confidentiality, integrity, and availability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 8.8, indicating a high level of severity.
Yes, the patched version of libvirt is 6.6.0-r0. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, consider implementing access restrictions to the QEMU process as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
