CVE-2011-2178: Medium severity red hat libvirt-daemon-driver-storage-iscsi-direct vulnerability
Regression introduced in commit d6623003 (v0.8.8) - using the wrong sizeof operand meant that security manager private data was overlaying the allowDiskFOrmatProbing member of struct virSecurityManager. This reopens disk probing, which was supposed to be prevented by the solution to CVE-2010-2238.
Upstream patch: https://www.redhat.com/archives/libvir-list/2011-May/msg01935.html
Other sources
The virSecurityManagerGetPrivateData function in security/securitymanager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users to read arbitrary files on the host OS. NOTE: this vulnerability exists because of a CVE-2010-2238 regression.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2178?
CVE-2011-2178 has been assigned a medium severity rating due to its potential to expose security manager private data.
How does CVE-2011-2178 affect libvirt versions 0.8.8, 0.9.0, and 0.9.1?
CVE-2011-2178 affects libvirt versions 0.8.8, 0.9.0, and 0.9.1 by allowing disk probing which was previously restricted.
How do I fix CVE-2011-2178?
To fix CVE-2011-2178, upgrade to a patched version of libvirt that addresses this vulnerability.
What is the nature of the vulnerability in CVE-2011-2178?
CVE-2011-2178 is a regression vulnerability which leads to improper handling of security manager's private data.
Can CVE-2011-2178 result in a disclosure of sensitive information?
Yes, CVE-2011-2178 can potentially lead to the disclosure of sensitive information through improper access controls.