Libvirt Security Notice: LSN-2013-0020

libvirtd crash when hot-plugging disks for qemu domains

Lifecycle

Credits

See also

• CVE-2013-6458
• redhat bug #1043069

Description

Several methods in the qemu block driver were accessing details about disks associated with a domain outside of a job lock. If another connection is adding or removing disks, the details in use by the first connection could become stale and lead to a libvirtd crash. Among the methods impacted, it is possible to trigger the race from four APIs accessible from read-only clients: virDomainBlockStats, virDomainGetBlockInfo, virDomainGetBlockJobInfo, and virDomainGetBlockIoTune.

Impact

Each of the four affected APIs could be used by any user that can connect through the read-only libvirtd UNIX domain socket. Also, if ACLs are active, access to the affected APIs is granted to any user with the 'read' permission on the 'domain' object, which is granted by default to all users. As a result an unprivileged user will be able to inflict a denial of service attack on other users of the libvirtd daemon with higher privilege.

Workaround

The impact can be mitigated by blocking access to the read-only libvirtd UNIX domain socket, with policykit or the 'auth_unix_ro' parameter in '/etc/libvirt/libvirtd.conf'. If ACLs are active, the 'read' permission should be removed from any untrusted users. This will not prevent the crash, but will stop unprivileged users from inflicting the denial of service on higher privileged users. Additionally, avoiding disk hot-plug actions is sufficient to avoid the problem.

Affected product: libvirt

Alternative formats: [xml] [text]