[arch-security] [Arch Linux Security Advisory ASA-201409-5] libvirt: out-of-bounds read access
levente at leventepolyak.net
Mon Sep 29 12:35:06 UTC 2014
Arch Linux Security Advisory ASA-201409-5
Date : 2014-09-29
CVE-ID : CVE-3633
Package : libvirt
Type : out-of-bounds read access
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE-2014
The package libvirt before version 1.2.8-2 is
vulnerable to an out-of-bounds read access in qemuDomainGetBlockIoTune()..
Upgrade to 1.2.8-2.
# pacman -Syu "libvirt>=1.2.8-2"
The problem has been fixed upstream  but no release is available yet.
The out-of-bounds access is only possible on domains that have had disks
hot-plugged or removed from the live image without also updating the
persistent definition to match; keeping the two definitions matched or
using only transient domains will avoid the problem. Denying access to
the readonly libvirt socket will avoid the potential for a denial of
service attack, but will not prevent the out-of-bounds access from
causing a crash for a privileged client, although such a crash is no
longer a security problem.
Luyao Huang of Red Hat found that the qemu implementation of
virDomainGetBlockIoTune computed an index into the array of disks
for the live definition, then used it as the index into the array of
disks for the persistent definition, which could result into an
out-of-bounds read access in qemuDomainGetBlockIoTune().
A remote attacker able to establish a read-only connection to
libvirtd could use this flaw to crash libvirtd or, potentially,
leak memory from the libvirtd process.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security