libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited...

Moderate: Red Hat Security Advisory: virt:av and virt-devel:av security and bug fix update

An update for the virt:av and virt-devel:av modules is now available for Red Hat Enterprise Linux Advanced Virtualization 8.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

libvirt: Insecure sVirt label generation

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality a...

[SECURITY] Fedora 34 Update: libvirt-7.0.0-7.fc34

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support...

The vulnerability of the Libvirt virtualization management library, related to authentication errors, allows a perpetrator to trigger a service failure.

The vulnerability of the Libvirt virtualization management library is related to the lack of authentication, allowing connections to only be set for read-only access. This means that libvirt waits for a response from the guest agent for a specified period of time. Exploiting this vulnerability...

The vulnerability of the API virConnectListAllNodeDevices in the Libvirt management library, when using the GRID driver, relates to a failure of the operation beyond the buffer boundaries in memory. This vulnerability allows an attacker to trigger a service failure.

The vulnerability of the API virConnectListAllNodeDevices in the Libvirt control library, when using the GRID driver, is related to the operation exceeding the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to trigger a service failure using the virsh...

The vulnerability of the HTTP cookie files in the Libvirt virtualization management library, related to improper deletion of critical data at the boundary, allows a hacker to access confidential data.

The vulnerability of the HTTP cookie file in the Libvirt virtualization management library is related to the storage of data in the dump XML file of the host domain. Exploiting this vulnerability allows a malicious actor to gain access to confidential data using the dumpxml command...

Moderate: Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.8]

An update for cockpit-ovirt, ovirt-host, ovirt-hosted-engine-ha, ovirt-hosted-engine-setup, and vdsm is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...

openSUSE: Security Advisory for libvirt (openSUSE-SU-2021:2812-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE 15 Security Update : libvirt (openSUSE-SU-2021:2812-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2812-1 advisory. - A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest t...

SUSE SLED15: libvirt / libvirt-admin / libvirt-bash-completion / libvirt-client / etc (SUSE-SU-2021:2812-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2812-1 advisory. Security issues fixed: - CVE-2021-3631: fix SELinux label generation logic bsc1187871 - CVE-2021-3667: Unlock object on ACL fail in...

SUSE: Security Advisory (SUSE-SU-2021:2812-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2021:2812-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issues fixed: - CVE-2021-3631: fix SELinux label generation logic bsc1187871 - CVE-2021-3667: Unlock object on ACL fail in storagePoolLookupByTargetPath bsc1188843 Non-security issues fixed: - virtlockd: Don't report error if lockspace...

SUSE-SU-2021:2812-1 Security update for libvirt

This update for libvirt fixes the following issues: Security issues fixed: - CVE-2021-3631: fix SELinux label generation logic bsc1187871 - CVE-2021-3667: Unlock object on ACL fail in storagePoolLookupByTargetPath bsc1188843 Non-security issues fixed: - virtlockd: Don't report error if lockspace...

Red Hat libvirt 安全漏洞

Red Hat libvirt is a Linux API for implementing Linux virtualization features from Red Hat, Inc. It supports a variety of Hypervisors, including Xen and KVM, as well as QEMU and a number of virtual products for other operating systems. A security vulnerability exists in Red Hat libvirt. No furthe...

Security update for libvirt (moderate)

openSUSE Security Update: Security update for libvirt Announcement ID: openSUSE-SU-2021:2812-1 Rating: moderate References: 1184253 1187871 1188232 1188843 Cross-References: CVE-2021-3631 CVE-2021-3667 CVSS scores: CVE-2021-3631 SUSE: 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-3667...

The vulnerability of the daemon and the set of tools for managing virtualization via libvirt, which are related to pointer dereferencing errors, allow a perpetrator to trigger a service failure.

The vulnerability of the daemon and the set of tools for managing virtualization via Libvirt are related to an error in the storage pool selection based on its target path. Exploiting this vulnerability allows a remote attacker to trigger a service failure...

Updated libvirt packages fix security vulnerability

Updated libvirt packages fix security vulnerability: insecure sVirt label generation CVE-2021-3631...

MGASA-2021-0399 Updated libvirt packages fix security vulnerability

Updated libvirt packages fix security vulnerability: insecure sVirt label generation CVE-2021-3631...

openSUSE 15 Security Update : libvirt (openSUSE-SU-2021:1119-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1119-1 advisory. - A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access...