Libvirt Security Notice: LSN-2009-0001

Incorrect buffer checks in setuid proxy

Lifecycle

Credits

See also

• CVE-2009-0036

Description

The setuid libvirt_proxy helper program allows unprivileged users read-only access to query the Xen hypervisor for information. On short reads of data packets from the client, incorrect buffer validation was being performed. This cloud lead to a buffer overflow in the setuid proxy

Impact

An unprivileged user can feed malicious packets to the setuid proxy causing a buffer overflow. This can potentially be used to cause the program to execute arbitrary code as root. The GCC stack protector did not protect against the flaw since the function was being inlined to the main() method by the compiler optimizer

Workaround

Remove the setuid permission bit from the /usr/libexec/libvirt_proxy helper binary. This will prevent unprivileged users from being able to use it to elevate their privileges.

Affected product: libvirt

Alternative formats: [xml] [text]