Security Update for libvirt
Summary
DSA-3038-1: libvirt - security update. Affects libvirt versions < 0.9.12.3-1+deb7u1. Fixed in 0.9.12.3-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libvirt is a virtualization abstraction library that provides a consistent API for managing different virtualization technologies. It allows applications to manage virtual machines, storage, and networks across various hypervisors. This vulnerability affects the libvirt package in Debian 7 (wheezy) and can lead to denial of service or memory leakage.
Vulnerability Detail
The vulnerability (CVE-2014-0179) in libvirt arises from the improper handling of XML documents using the libxml2 library. When parsing XML documents, libvirt passes the XML_PARSE_NOENT flag, causing all XML entities to be expanded. An attacker can exploit this flaw by forcing libvirtd to parse an XML document with an entity pointing to a special file that blocks read access. This can result in libvirtd hanging indefinitely, leading to a denial of service on the system. Another vulnerability (CVE-2014-3633) involves an out-of-bounds read access in qemuDomainGetBlockIoTune(), which can be exploited by a remote attacker with a read-only connection to libvirtd to crash the service or leak memory from the libvirtd process.
How To Fix
Minimum fixed version
0.9.12.3-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
Libvirt has been updated to address these vulnerabilities. It is crucial to upgrade to the fixed versions to ensure the security and stability of your system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvirt →
FAQ
Libvirt is a virtualization abstraction library that provides a consistent API for managing different virtualization technologies.
The vulnerabilities can lead to denial of service or memory leakage in the libvirtd process.
By forcing libvirtd to parse an XML document with a specially crafted entity that blocks read access, an attacker can cause libvirtd to hang indefinitely, resulting in a denial of service.
A remote attacker with a read-only connection to libvirtd can crash the service or leak memory from the libvirtd process.
Upgrade the libvirt package to the recommended versions: 0.9.12.3-1+deb7u1 for Debian 7 (wheezy) and 1.2.8-2 or later for the unstable distribution (sid).
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
