CVE-2010-2242
First published: Wed Jun 09 2010(Updated: )
Jeremy Nickurak reported an issue with how libvirt creates iptables rules when guest systems are setup for masquerading. The iptables rule will be of the following format: # iptables-save -t nat # Generated by iptables-save v1.4.7 on Wed Jun 9 14:59:03 2010 *nat :PREROUTING ACCEPT [45:5146] :POSTROUTING ACCEPT [889:54117] :OUTPUT ACCEPT [889:54117] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE COMMIT # Completed on Wed Jun 9 14:59:03 2010 With masquerading, outgoing connections will have their source-port mapped to a NAT-selected port, and the iptables default is for privileged ports to be mapped to privileged (<1024) ports. This will allow users in guests that have root privileges (in the guest, independent of their privileges on the host), to obtain privileged resources on the host, as well as being able to access other resources by using it. One example is with standard NFS exports now being accessible to the guests, because the guests will appear to be from the same IP as a possibly trusted host. To illustrate: regular-user@host-machine:~$ ssh guest-machine Last login: Wed Jun 9 11:33:13 2010 from host-machine regular-user@guest-machine:~$ sudo mount -t nfs -o udp,rw,soft remote-nfs-server:/some-export /mnt/tmp (get UID of resources on the remote NFS server, and create a user in the guest with that UID> (su to that new UID) user-with-same-uid@guest-machine:~$ cp -R /mnt/tmp/secret-data /home/mycopy; rm -Rf /mnt/tmp/secret-data A normal user account would not normally be able to do something like this because they cannot bind to the privileged port, however in this case the NAT rules permits it. An example modified set of iptables rules that may solve the problem was supplied as well: /sbin/iptables -t nat -A POSTROUTING -p tcp -o $(IFACE) -j MASQUERADE --to-ports 1024-65535 /sbin/iptables -t nat -A POSTROUTING -p udp -o $(IFACE) -j MASQUERADE --to-ports 1024-65535 /sbin/iptables -t nat -A POSTROUTING -p icmp -o $(IFACE) -j MASQUERADE The above uses the --to-ports option that forces iptables' masquerading module to only map guest reqursts to non-privileged ports. Acknowledgements: Red Hat would like to thank Jeremy Nickurak for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Libvirt Libvirt | =0.4.1 | |
| Libvirt Libvirt | =0.5.1 | |
| Libvirt Libvirt | =0.6.0 | |
| Libvirt Libvirt | =0.7.3 | |
| Libvirt Libvirt | =0.2.0 | |
| Libvirt Libvirt | =0.8.1 | |
| Libvirt Libvirt | =0.3.1 | |
| Libvirt Libvirt | =0.7.0 | |
| Libvirt Libvirt | =0.6.1 | |
| Libvirt Libvirt | =0.4.0 | |
| Libvirt Libvirt | =0.8.0 | |
| Libvirt Libvirt | =0.6.5 | |
| Libvirt Libvirt | =0.2.1 | |
| Libvirt Libvirt | =0.7.1 | |
| Libvirt Libvirt | =0.4.6 | |
| Libvirt Libvirt | =0.2.3 | |
| Libvirt Libvirt | =0.4.2 | |
| Libvirt Libvirt | =0.3.3 | |
| Libvirt Libvirt | =0.6.2 | |
| Libvirt Libvirt | =0.7.6 | |
| Libvirt Libvirt | =0.7.4 | |
| Libvirt Libvirt | =0.6.4 | |
| Libvirt Libvirt | =0.5.0 | |
| Libvirt Libvirt | =0.7.7 | |
| Libvirt Libvirt | =0.3.2 | |
| Libvirt Libvirt | =0.4.4 | |
| Libvirt Libvirt | =0.7.5 | |
| Libvirt Libvirt | =0.7.2 | |
| Libvirt Libvirt | =0.3.0 | |
| Libvirt Libvirt | =0.6.3 | |
| Libvirt Libvirt | =0.2.2 | |
| Libvirt Libvirt | =0.8.2 | |
| Libvirt Libvirt | =0.4.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/591943
- http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044520.html
- https://bugzilla.redhat.com/show_bug.cgi?id=602455
- http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044579.html
- http://libvirt.org/news.html
- http://www.redhat.com/support/errata/RHSA-2010-0615.html
- http://www.vupen.com/english/advisories/2010/2062
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
- http://www.vupen.com/english/advisories/2010/2763
- http://ubuntu.com/usn/usn-1008-3
- http://ubuntu.com/usn/usn-1008-1
- http://ubuntu.com/usn/usn-1008-2
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=422978&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=422978&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=613625
- https://rhn.redhat.com/errata/RHSA-2010-0615.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=624536
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-2242
- agent/tags
- agent/trending
- vendor/libvirt
- canonical/libvirt libvirt
- version/libvirt libvirt/0.4.1
- version/libvirt libvirt/0.5.1
- version/libvirt libvirt/0.6.0
- version/libvirt libvirt/0.7.3
- version/libvirt libvirt/0.2.0
- version/libvirt libvirt/0.8.1
- version/libvirt libvirt/0.3.1
- version/libvirt libvirt/0.7.0
- version/libvirt libvirt/0.6.1
- version/libvirt libvirt/0.4.0
- version/libvirt libvirt/0.8.0
- version/libvirt libvirt/0.6.5
- version/libvirt libvirt/0.2.1
- version/libvirt libvirt/0.7.1
- version/libvirt libvirt/0.4.6
- version/libvirt libvirt/0.2.3
- version/libvirt libvirt/0.4.2
- version/libvirt libvirt/0.3.3
- version/libvirt libvirt/0.6.2
- version/libvirt libvirt/0.7.6
- version/libvirt libvirt/0.7.4
- version/libvirt libvirt/0.6.4
- version/libvirt libvirt/0.5.0
- version/libvirt libvirt/0.7.7
- version/libvirt libvirt/0.3.2
- version/libvirt libvirt/0.4.4
- version/libvirt libvirt/0.7.5
- version/libvirt libvirt/0.7.2
- version/libvirt libvirt/0.3.0
- version/libvirt libvirt/0.6.3
- version/libvirt libvirt/0.2.2
- version/libvirt libvirt/0.8.2
- version/libvirt libvirt/0.4.3