Libvirt Security Notice: LSN-2014-0002

Missing access control check on events

Lifecycle

Credits

See also

• CVE-2014-0028

Description

The asynchronous events were not filtered based on any permission check prior to being dispatched to the client. This could lead to the client learning about the existence of domains that they are not authorized to see.

Impact

A client can use events to learn of domains that they are not authorized to see. Additionally, the client can use that object to attempt other actions on the domain, such as starting or stopping it.

Workaround

Prevent untrusted clients from connecting to libvirtd

Affected product: libvirt

Alternative formats: [xml] [text]