Libvirt Security Notice: LSN-2015-0001
======================================
Summary: snapshots and save images leak VNC passwords
Reported on: 20150120
Published on: 20150122
Fixed on: 20150122
Reported by: Luyao Huang <lhuang@xxxxxxxxxx>
Patched by: Peter Krempa <pkrempa@xxxxxxxxxx>
See also: CVE-2015-0236
Description
-----------
The two interfaces virDomainSnapshotGetXMLDesc and
virDomainSaveImageGetXMLDesc would accept the VIR_DOMAIN_XML_SECURE
flag in situations where virDomainGetXMLDesc did not, when
fine-grained access control lists (ACL) are in use. As a result, a
client can use a snapshot or save image to bypass restrictions and
gain access to the secured information.
Impact
------
A client using a read-write connection, and which has the
'domain:read' ACL privilege while lacking 'domain:secure_read', can
trigger an information leak of data by using VIR_DOMAIN_XML_SECURE
with the affected interfaces. Fortunately, the only data in this
category is the value of an optional VNC password.
Workaround
----------
VNC passwords are notoriously weak (they are capped at an 8 byte
maximum length; the VNC protocol sends them in plaintext over the
network; and FIPS mode execution prohibits the use of a VNC
password), so it is recommended that users not create domains with a
VNC password in the first place. Domains that do not use VNC
passwords do not suffer from information leaks; the use of SPICE
connections is recommended not only because it avoids the leak, but
also because SPICE provides better features than VNC for a guest
graphics device. Furthermore, the leak is only possible when
fine-grained ACLs are in use; read-only clients cannot trigger the
issue. Therefore, the problem is avoided if no user is granted the
'read' ACL privilege without also having the 'read_secure'
privilege. Another mitigation is that the information leak can only
occur if a snapshot or save image exists; a user that is denied
'read_secure' is typically also unable to create such an image, so
the leak depends on a more privileged user making use of that
feature.
Affected product
----------------
Name: libvirt
Repository: git://libvirt.org/git/libvirt.git
http://libvirt.org/git/?p=libvirt.git
Branch: master
Broken in: v1.1.0
Broken in: v1.1.1
Broken in: v1.1.2
Broken in: v1.1.3
Broken in: v1.1.4
Broken in: v1.2.0
Broken in: v1.2.1
Broken in: v1.2.2
Broken in: v1.2.3
Broken in: v1.2.4
Broken in: v1.2.5
Broken in: v1.2.6
Broken in: v1.2.7
Broken in: v1.2.8
Broken in: v1.2.9
Broken in: v1.2.10
Broken in: v1.2.11
Fixed in: v1.2.12
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 03c3c0c874c84dfa51ef17556062b095c6e1c0a3
Fixed by: b1674ad5a97441b7e1bd5f5ebaff498ef2fbb11b
Branch: v1.1.0-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: a976724f9a10730e1339628482a283653efdb72c
Fixed by: c4c824ec818ce85de049ed5546fa8ce3c8b76e32
Branch: v1.1.1-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 9a2728e1b28b67a682e55d8dd3c0d79e21f0ad37
Fixed by: 2c6fc46d987911e310d30621cd6fc195af102fee
Branch: v1.1.2-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 6eec2b830a752c95fc2d971d3daf7626f9701290
Fixed by: 947c969fc248c2324e565b5e4f80a3d11733f12b
Branch: v1.1.3-maint
Broken in: v1.1.3.1
Broken in: v1.1.3.2
Broken in: v1.1.3.3
Broken in: v1.1.3.4
Broken in: v1.1.3.5
Broken in: v1.1.3.6
Broken in: v1.1.3.7
Broken in: v1.1.3.8
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: ca840e9c827fefadae2e00875b4a552b990b959f
Fixed by: 76d6cc3f24ab545694e77e2eafa981d861b965a4
Branch: v1.1.4-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 43d16684c2018c20db1fba35542eb1d52ecb8d7a
Fixed by: 17defce9159c5111e7011e575ba72803a9418086
Branch: v1.2.0-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 9475a25c86f3748e2069af67db69d79864b707b9
Fixed by: 8abca887b19600b6652654a01a78455afd4d8294
Branch: v1.2.1-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: f7c70c20530954c2c1a2ce0d192d01a8f71c0093
Fixed by: 1f348188e0698ef2535c81d5a779189531c5df99
Branch: v1.2.2-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: e99c25ca63c695a63b4c9b91ee956be4fb660772
Fixed by: 8107c1e3694ba4685960ec09868076379718f037
Branch: v1.2.3-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 4edae3cb9600132e875a5b97cf31089a6c8f4cb2
Fixed by: 94d18e8f6dbe3afdc72b6df13e3eaa8861874a14
Branch: v1.2.4-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: d406f0858e7e3a6199788d3c64217c69d7702032
Fixed by: 4700507a484aec43b02724893cbed931e52f86e0
Branch: v1.2.5-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: b0b5e885f05a80d63e8a457031ea884e867244ad
Fixed by: 6b78ba5a15fb1077cee88cc30f1e5ba16485cd83
Branch: v1.2.6-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 9b056d8daf68b6357ca05adbfddb53a85d077a1d
Fixed by: b87f3f835a5c88625d9514aae9a2ddf30bc64319
Branch: v1.2.7-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: cc0cc987a53f5e3825c7d972e219e08688d4480b
Fixed by: aeb505814531d505f4d7718a10a96dd6dea14457
Branch: v1.2.8-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: c0f3e664a68509a3d842bdc3fd126257da46d0c0
Fixed by: cef411296b2513ffd80dbf9cab1f54bd0c68fe6a
Branch: v1.2.9-maint
Broken in: v1.2.9.1
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 19f8fec02d9b0a8de877d872c5b59597bd878a8d
Fixed by: 295f3c88ce71b8e83a489cb0d48431e124c12081
Branch: v1.2.10-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: c379b17e259db4f07843c2a7a883fda1a1bd043f
Fixed by: d6e10847e0cd2bd7fc1824ad65fe859987715881
Branch: v1.2.11-maint
Broken by: e341435e5090677c67a0d3d4ca0393102054841f
Fixed by: 41358b7e91a20c9a89b03202b8c4139f92dd1953
Fixed by: 7195a5fa4718d915b28bb6e3380255eb1fbf994a
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list