REDHAT-BUG-1077620: Medium severity libvirt vulnerability
Description of the problem:
Domblkstat is possible even with read-only connection, so whenever migration with spice is done and domblkstat gets called at the same time as qemuMonitorGetSpiceMigrationStatus(), there is certain possibility that the daemon crashes.
An unprivileged user able to issue commands to running libvirtd could use this flaw to crash libvirtd and prevent more privileged clients from working correctly.
Upstream fix: http://libvirt.org/git/?p=libvirt.git;a=commit;h=484cc321
Acknowledgements:
This issue was discovered by Marian Krcmarik of Red Hat.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1077620?
The severity of REDHAT-BUG-1077620 is considered to be critical due to the potential for daemon crashes during migration.
How do I fix REDHAT-BUG-1077620?
To fix REDHAT-BUG-1077620, ensure you apply the latest patches provided by Red Hat for libvirt.
Which versions of libvirt are affected by REDHAT-BUG-1077620?
All versions of libvirt that contain the specific bug are affected, so checking the changelog and updates is essential.
Can unprivileged users exploit REDHAT-BUG-1077620?
Yes, unprivileged users can potentially exploit the vulnerability in REDHAT-BUG-1077620 during migration operations.
What conditions lead to the crash in REDHAT-BUG-1077620?
The crash in REDHAT-BUG-1077620 occurs when domblkstat is called simultaneously with qemuMonitorGetSpiceMigrationStatus during migration.