Libvirt Security Notice: LSN-2010-0004

Improperly mapped virtual network source privileged ports

Lifecycle

Credits

See also

• CVE-2010-2242
• ubuntu bug #591943

Description

When a virtual network is setup to use NAT based forwarding, outgoing connections will have their source port mapped to a NAT selected port. By default iptables will attempt to map privileged ports to privileged ports and libvirt does not make any attempt to override this default logic.

Impact

If an network service is configured to allow access by a virtualization host, by checking if the source port is less than 1024, then it is possible for a guest connected to a NAT based virtual network to gain access to network services only intended to be used by the host. For example, an NFS filesystem exported to the virtualization host relying on IP based security with the "secure" option will be inadvertently accessible to guests.

Workaround

Configure network services to use a strong authentication mechanism instead of relying on source port number validation. Place the guest on a completely separate IP address subnet from the host network.

Affected product: libvirt

Alternative formats: [xml] [text]