Libvirt Security Notice: LSN-2013-0012

Insecure invocation of polkit for checking authorization

Lifecycle

Credits

See also

• CVE-2013-4311

Description

There is a race condition in the way libvirt invokes the pkcheck binary, which could result in polkit doing the authorization check against the wrong user ID

Impact

A malicious libvirt client can have one thread exec a setuid application in parallel with another thread authenticating to libvirt. This would result in polkit authorizing the libvirt client as if it were running user ID 0. An unprivileged user can thus elevate their privileges.

Workaround

Disable all use of polkit authentication in the libvirtd server and use of the polkit access control driver.

Affected product: libvirt

Alternative formats: [xml] [text]