CVE-2014-0028: Medium severity redhat libvirt vulnerability
Eric Blake from Red Hat reports that ever since libvirt 1.1.1 added ACL domain:getattr filtering for commands like virConnectListAllDomains, we have had a latent problem that the use of virConnectDomainEventRegister() and virConnectDomainEventRegisterAny() can be used to learn about virDomainPtr objects that should have been inaccessible to the user. It is not a problem if you are not using ACLs; also, it is partially mitigated by the fact that any domain that does not trigger an event in the timeframe where the attacker maintains their event callback will not be leaked.
Once an attacker has learned about a domain by bypassing domain:getattr, they could perform other actions on the domain if there were not ACLs to filter those actions too, such as starting and stopping the domain.
Other sources
libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:searchdomains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0028?
CVE-2014-0028 is classified as a moderate severity vulnerability.
How do I fix CVE-2014-0028?
To remediate CVE-2014-0028, you should upgrade to a fixed version of libvirt, such as 1.2.0 or later.
What versions of libvirt are affected by CVE-2014-0028?
CVE-2014-0028 affects libvirt versions 1.1.1 to 1.1.4.
What types of attacks can leverage CVE-2014-0028?
CVE-2014-0028 can potentially allow unauthorized access to sensitive domain information via event registration commands.
Who reported CVE-2014-0028?
CVE-2014-0028 was reported by Eric Blake from Red Hat.