Bug 904176 (CVE-2014-7823) - VUL-1: CVE-2014-7823: libvirt: Information leak with flag VIR_DOMAIN_XML_MIGRATABLE
Summary: VUL-1: CVE-2014-7823: libvirt: Information leak with flag VIR_DOMAIN_XML_MIGR...
Status: RESOLVED FIXED
Alias: CVE-2014-7823
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/110493/
Whiteboard: maint:released:sle11-sp3:60370
Keywords:
Depends on:
Blocks:
 
Reported: 2014-11-06 09:17 UTC by Johannes Segitz
Modified: 2015-02-24 10:36 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2014-11-06 09:17:01 UTC
Commit 28f8dfd (v1.0.0) introduced a problem that allows with at least the qemu implementation of virDomainGetXMLDesc, the use
of the flag VIR_DOMAIN_XML_MIGRATABLE (which is usable from a
read-only connection) to trigger the implicit use of
VIR_DOMAIN_XML_SECURE prior to calling qemuDomainFormatXML.
However, the use of VIR_DOMAIN_XML_SECURE is supposed to be restricted
to read-write clients only.  

A remote attacker able to establish a read-only connection to libvirtd
could use this flaw to cause leak certain limited information from the
domain xml file.

SLE 11 SP3, SLE12 and openSUSE 12.3, 13.1 and 13.2 seem to be affected.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1160817
https://www.redhat.com/archives/libvir-list/2014-November/msg00114.html
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7823
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-7823.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7823
Comment 2 Swamp Workflow Management 2014-11-06 23:00:23 UTC
bugbot adjusting priority
Comment 3 James Fehlig 2014-11-11 15:25:04 UTC
Now that 13.2 is out, is openSUSE12.3 still maintained?
Comment 4 Johannes Segitz 2014-11-11 15:53:05 UTC
yes, there are some months overlap
Comment 5 Bernhard Wiedemann 2014-11-11 19:00:27 UTC
This is an autogenerated message for OBS integration:
This bug (904176) was mentioned in
https://build.opensuse.org/request/show/260932 12.3 / libvirt
https://build.opensuse.org/request/show/260933 13.1 / libvirt
https://build.opensuse.org/request/show/260934 Factory / libvirt
Comment 6 James Fehlig 2014-11-11 19:15:37 UTC
Ok, I've backported the fix all over the place

openSUSE12.3 - MR#260932
openSUSE13.1 - MR#260933
openSUSE13.2 - MR#260937
openSUSE Factory - SR#260934

For SLE11 SP3 and SLE12, fix is queued for future maintenance update.

I think I'm done here.  Passing to security-team...
Comment 7 Bernhard Wiedemann 2014-11-11 20:00:21 UTC
This is an autogenerated message for OBS integration:
This bug (904176) was mentioned in
https://build.opensuse.org/request/show/260937 13.2 / libvirt
Comment 8 Swamp Workflow Management 2014-11-21 09:05:26 UTC
openSUSE-SU-2014:1471-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 904176
CVE References: CVE-2014-7823
Sources used:
openSUSE 13.2 (src):    libvirt-1.2.9-4.2
openSUSE 13.1 (src):    libvirt-1.1.2-2.40.1
openSUSE 12.3 (src):    libvirt-1.0.2-1.26.1
Comment 10 Marcus Meissner 2015-02-09 14:12:40 UTC
released
Comment 11 Swamp Workflow Management 2015-02-09 15:09:30 UTC
SUSE-SU-2015:0241-1: An update that solves three vulnerabilities and has 9 fixes is now available.

Category: security (moderate)
Bug References: 891936,899334,899484,900587,902976,903756,904176,904426,904432,909828,910862,911737
CVE References: CVE-2014-3657,CVE-2014-7823,CVE-2014-8136
Sources used:
SUSE Linux Enterprise Workstation Extension 12 (src):    libvirt-1.2.5-21.1
SUSE Linux Enterprise Software Development Kit 12 (src):    libvirt-1.2.5-21.1
SUSE Linux Enterprise Server 12 (src):    libvirt-1.2.5-21.1
SUSE Linux Enterprise Desktop 12 (src):    libvirt-1.2.5-21.1
Comment 12 Swamp Workflow Management 2015-02-23 23:08:09 UTC
SUSE-SU-2015:0357-1: An update that solves 6 vulnerabilities and has 9 fixes is now available.

Category: security (moderate)
Bug References: 843074,852397,878350,879665,897654,897783,899144,899484,900084,904176,905097,907805,908381,910145,911742
CVE References: CVE-2014-3633,CVE-2014-3640,CVE-2014-3657,CVE-2014-7823,CVE-2014-7840,CVE-2014-8106
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    libvirt-1.0.5.9-0.19.3, libvirt-1.0.5.9-0.19.6
SUSE Linux Enterprise Server 11 SP3 (src):    kvm-1.4.2-0.21.4, kvm-1.4.2-0.21.5, libvirt-1.0.5.9-0.19.3, libvirt-1.0.5.9-0.19.5, libvirt-1.0.5.9-0.19.6
SUSE Linux Enterprise Desktop 11 SP3 (src):    kvm-1.4.2-0.21.4, libvirt-1.0.5.9-0.19.3