libvirt vulnerabilities

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of 'verify-peer=no', resulting in a failure to validate SSL/TLS certificates by default.

In libvirt versions before 2.0.0, password checking is improperly disabled when the password on a VNC server is set to an empty string. This allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

A flaw in libvirt allows an unprivileged local user to exploit an integer overflow in the NodeGetFreePages RPC handler, bypassing a size check and leading to a heap buffer overflow. This can corrupt the root libvirt daemon's memory, potentially causing DoS or local privilege escalation.

A vulnerability was found in libvirt where the virFileChownFiles() function follows symbolic links. A local attacker running as the swtpm user can plant a symlink in the swtpm state directory, causing the root-level libvirt daemon to change ownership of an arbitrary file to the swtpm user.

In libvirt, during storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

A flaw was found in libvirt where external inactive snapshots for shut-down VMs are incorrectly created as world-readable, allowing unprivileged users to inspect guest OS contents. This results in an information disclosure vulnerability.

A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

A flaw was found in libvirt where the virStoragePoolObjListSearch function does not return a locked pool as expected, leading to a race condition and denial of service when attempting to lock the same object from another thread.