CVE-2009-0036: Buffer Overflow
A buffer overflow flaw was found in libvirtproxy. libvirtproxy is set to run as a setuid root by default, so in theory this could allow for a local user to become root.
Normally the stack protector would prevent this from being an issue, but it seems that with gcc optimizations, the function in question is being inlined into main(), preventing the stack protector from catching this.
The original report can be found here: https://www.redhat.com/archives/libvir-list/2009-January/msg00699.html
The patch is here: http://git.et.redhat.com/?p=libvirt.git;a=commitdiff;h=2bb0657e28
Other sources
Buffer overflow in the proxyReadClientSocket function in proxy/libvirtproxy.c in libvirtproxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 2bb0657e28 - Configuration
Remove the setuid root bit from the libvirt_proxy binary so it does not run setuid root (ensure the binary is not owned/executed with setuid privileges).
libvirt_proxy setuid = disabled - Compensating control
Restrict local access to the libvirt_proxy binary to trusted administrators (e.g., change filesystem permissions to allow execution only by root/administrators or apply local ACLs) to limit potential exploitation by local users.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0036?
CVE-2009-0036 is considered to have high severity due to the potential for local users to escalate privileges to root.
How do I fix CVE-2009-0036?
To fix CVE-2009-0036, upgrade to a version of libvirt that contains the patch for this buffer overflow vulnerability.
What causes the vulnerability CVE-2009-0036?
CVE-2009-0036 is caused by a buffer overflow flaw in the libvirt_proxy component that runs as setuid root.
Can CVE-2009-0036 be exploited remotely?
CVE-2009-0036 cannot be exploited remotely; it requires local access to the affected system.
Who is affected by CVE-2009-0036?
Users of libvirt version 0.5.1 are affected by CVE-2009-0036, especially those with setuid root configurations.