Libvirt Security Notice: LSN-2008-0001

Missing checks for read only connections on many APIs

Lifecycle

Credits

See also

• CVE-2008-5086

Description

The APIs virDomainMigrate, virDomainBlockPeek, virDomainMemoryPeek, virDomainSetAutostart, virNetworkSetAutostart, virConnectFindStoragePoolSources and virStoragePoolSetAutostart did not check the read-only flag of the connection. This allowed unprivileged users to invoke APIs that they should not have access to.

Impact

The default libvirt configuration allows all local user accounts read-only access to the libvirtd daemon. Any local user can migrate a running virtual machine to a host of their choice. Any local user can change whether virtual machines, networks or storage pools started automatically on boot. Any local user can trigger discovery of storage pools. Any local user can peek into the disk image or memory of running guests.

Workaround

Edit the /etc/libvirt/libvirtd.conf configuration file, to set the 'unix_sock_ro_perms = "0700"' to prevent local users from connecting to libvirt. Alternatively setup a policy kit rule to prevent them access without first authenticating as root.

Affected product: libvirt

Alternative formats: [xml] [text]