Libvirt Security Notice: LSN-2016-0002

Access to virDomainGetTime mistakenly allowed on read-only connection

Lifecycle

Credits

See also

• CVE-2016-10746

Description

The virDomainGetTime API will talk to a guest agent on some hypervisors like QEMU, and so must be forbidden on read-only connections to libvirt

Impact

An unprivileged user on the virtualization host can invoke the virDomainGetTime API which talks to the QEMU guest agent. If this user also has administrative privileges in the guest, they can use a malicious guest agent to inflict a denial of service on libvirt potentially blocking further API calls on that guest for a period of time.

Workaround

Disable the QEMU agent in any VMs whose admin is not trustworthy. Alternative reconfigure the host access control to block use of the readonly libvirtd socket

Affected product: libvirt

Alternative formats: [xml] [text]