Libvirt Security Notice: LSN-2018-0003

Insecure usage of NSS modules during container startup

Lifecycle

Credits

See also

• CVE-2018-6764

Description

During container startup it is possible that libvirt logging code will trigger a hostname lookup. This will in turn potentially cause GLibC to load various NSS modules from the container's root filesystem rather than the host's root filesystem. During this time the host's root filesystem is still accessible and fully writable

Impact

A maliciously crafted NSS module in the container's root filesystem can exploit the host OS by writing content into the host's root filesystem

Workaround

There is no practical workaround

Affected product: libvirt

Alternative formats: [xml] [text]