Libvirt Security Notice: LSN-2019-0007

virConnect*HypervisorCPU do not check for read-only connection

Lifecycle

Credits

See also

• CVE-2019-10168

Description

The virConnect*HypervisorCPU APIs allow reporting CPU capabilities from arbitrary emulator binaries without checking for a read-only connection. This allows unprivileged users to execute arbitrary binaries with elevated privileges.

Impact

The default libvirt configuration allows all local user accounts read-only access to the libvirtd daemon. Any local user can provide an arbitrary emulator, executing arbitrary binaries as the configured QEMU user. Since v5.1.0, the emulator binary is run with CAP_DAC_OVERRIDE, essentially having root privileges.

Workaround

Edit the /etc/libvirt/libvirtd.conf configuration file, to set the 'unix_sock_ro_perms = "0700"' to prevent local users from connecting to libvirt. Alternatively setup a policy kit rule to prevent them access without first authenticating as root.

Affected product: libvirt

Alternative formats: [xml] [text]