RHSA-2018:3113 - Security Advisory

Topic

An update for libvirt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

The following packages have been upgraded to a later upstream version: libvirt (4.5.0). (BZ#1563169)

Security Fix(es):

• libvirt: guest could inject executable code via libnss_dns.so loaded by libvirt_lxc before init (CVE-2018-6764)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, libvirtd will be restarted automatically.

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Virtualization 4 for RHEL 7 x86_64
• Red Hat Gluster Storage Server for On-premise 3 for RHEL 7 x86_64
• Red Hat Virtualization for IBM Power LE 4 for RHEL 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 916061 - Dump progress only show up when memory-only dump finish
• BZ - 1149445 - [RFE] Detection of cloned environment using a unique, inmutable, intelligent identifier programmically accessible - libvirt
• BZ - 1291851 - support for virtio-vsock - libvirt
• BZ - 1300772 - RFE: add support for native TLS encryption on NBD for disk migration
• BZ - 1367238 - libvirt allow set busNr and numa node for a pci-bridge but won't use it
• BZ - 1425058 - [RFE] libvirt: Provide a way to disable ROM loading completely for a device
• BZ - 1425757 - RFE: add support for securely passing passwords to iSCSI block drivers
• BZ - 1447169 - [RFE] Support hotplugging/unplugging of i6300esb watchdog
• BZ - 1448149 - <memoryBacking> <access mode='shared'/> is ignored if no NUMA nodes are configured
• BZ - 1454709 - delete the Qos settings for the interface on the fly makes no changes
• BZ - 1456165 - The sub-element for panic device should be "interleave" in rng file
• BZ - 1468422 - Libvirt crashed with SIGSEGV when creating a luks encrypted volume via an xml file without 'secret' element
• BZ - 1469338 - RFE: expose Q35 extended TSEG size in domain XML element or attribute
• BZ - 1470007 - [RFE] [libvirt part] Add S3 PR support to qemu (similar to mpathpersist)
• BZ - 1480668 - RFE: Enhance qemu to support freeing memory before exit when using memory-backend-file
• BZ - 1483816 - Schema for the 'target' field in <controller model='pci-bridge'> should not accept 'chassis' and 'port' parameters for 'q35' machine type
• BZ - 1490158 - Libvirt could not reconnect qemu
• BZ - 1492597 - Enable seccomp by out of the box with QEMU >= 2.11
• BZ - 1494454 - RFE: add sanity checks for shared storage when migrating without block copy
• BZ - 1507737 - virsh prompt doesn't change after changing the connection to readonly
• BZ - 1509870 - Command "virsh set-lifecycle-action --help" raises abnormal error info
• BZ - 1515533 - Libvirt should report correct error info when prefix is set out of range
• BZ - 1519146 - Libvirt uses deprecated compat=xxx option
• BZ - 1520821 - RFE: Add Generic PCIe-PCI bridge for libvirt
• BZ - 1522706 - Inexact error info when undefine a running uefi guest without flags
• BZ - 1523564 - Start vm with hostdev <source protocol='vhost' ...> will cause unknown error.
• BZ - 1524399 - client-info return incorrect readonly info when connected by tcp/tls in readonly mode
• BZ - 1525496 - libvirtd fails to reconnect to a qemu process after creating 200 snapshots in a chain
• BZ - 1525599 - Support pseries cap-htm qemu option in libvirt
• BZ - 1526382 - Cannot vol-create qcow2 encrypted volume due to qemu-img params changed
• BZ - 1527740 - NVRAM/pflash on a backing device is not created in the mount namespace
• BZ - 1529059 - The error message is not clear when upload a bigger file by vol-upload
• BZ - 1529256 - Error message is not correct when "vol-upload" a non-existing file with vol-key in logical/iscsi pool
• BZ - 1530451 - Failed to start guest when duplicate mount point existing in the /dev
• BZ - 1532542 - Blockcopy failed when using --bandwidth option with the values in the normal range
• BZ - 1534418 - guest can start with huge pages set to non-exist guest numa node
• BZ - 1538570 - Segmentation fault when run some virt-admin help srv* cmd.
• BZ - 1541444 - CVE-2018-6764 libvirt: guest could inject executable code via libnss_dns.so loaded by libvirt_lxc before init
• BZ - 1541921 - cachetune cannot work with TCG guest
• BZ - 1543775 - 'update-device' with alias in disk did not work actually and 'cold-plug' device with alias to running VM will fail in dumpxml file
• BZ - 1544325 - libvirt cannot parse json backing file with nbd socket keys
• BZ - 1544659 - can't detach disk with ceph auth backing file
• BZ - 1544869 - RFE: add support for native TLS encryption for NBD disk access
• BZ - 1546971 - Cannot modify vNIC profile of running VM
• BZ - 1547250 - Got lots OVS daemon ERRs while starting a OVS-dpdk guest
• BZ - 1549531 - Use of md5 / sha256 from gnulib prevents FIPS compliance
• BZ - 1552092 - request to qemu-guest-agent prevent other calls to qemu monitor
• BZ - 1552127 - qemu-kvm cannot find USB bus
• BZ - 1553075 - User-aliases not cleared on detach-device
• BZ - 1554876 - Device alias for input device do not take effect when hot-plugging
• BZ - 1556828 - [SR-IOV] - Can't start VM with SR-IOV vNIC
• BZ - 1557769 - Start VM with direct LUN attached with SCSI Pass-Through enabled fails on libvirtError
• BZ - 1558317 - VM can not start when configuring alias for ccid controller
• BZ - 1559284 - rpm verify show mode differs for package libvirt-daemon-config-nwfilter
• BZ - 1559835 - [RFC] Fine-grained API to validate if a given CPU model and flags are supported by QEMU / KVM
• BZ - 1560917 - vmx parser cannot import more than 4 NICs
• BZ - 1560946 - [RFE] support luks encrypted volume in disk pool
• BZ - 1560976 - Hosted Engine VM (deployed in the past) fails to reboot with 'libvirtError: internal error: failed to format device alias for PTY retrieval' due to an error in console device in libvirt XML generated by the engine
• BZ - 1563169 - Rebase libvirt to current upstream release
• BZ - 1566416 - Storage device fails to validate for extra content " logical_block_size"
• BZ - 1568148 - libvirt: vpx:// driver does not get CPU vendor, model or topology from VMware server
• BZ - 1568407 - Guest is left paused on source host sometimes if kill source libvirtd during live migration due to QEMU image locking
• BZ - 1569678 - virsh capabilities reports invalid values for 4K pages
• BZ - 1569861 - Timed out during operation: cannot acquire state change lock (held by remoteDispatchDomainMemoryStats)
• BZ - 1571759 - Create Volume on ESX local storage via virsh failed while use new libvirt
• BZ - 1572491 - virt-xml-validate validate fails for capabilities and storagevol
• BZ - 1576464 - Hash operation not allowed during iteration
• BZ - 1576916 - Detach device with partial XML that includes an alias
• BZ - 1583484 - "Property '.write-cache' not found" when set cache mode for scsi block device
• BZ - 1583623 - Attach scsi controller with 'driver' configured to VM will raise confusing error info
• BZ - 1583927 - "Unexpected hostdev type while encoding audit message: 4" when attach a mdev device.
• BZ - 1584071 - Unknown error occurred on target host when try to get completed domjobinfo
• BZ - 1584073 - Introduce support for mediated devices hotplug
• BZ - 1584091 - libvirt: vpx:// driver does not accept a number of vCPUs when it is not 1 or a multiple of 2
• BZ - 1584571 - RFE: qemu: support redirdev hotunplug
• BZ - 1586027 - virsh detach-device-alias --config does not work
• BZ - 1588295 - the help info of 'virsh detach-disk --print-xml' is not accurate
• BZ - 1588336 - "domifaddr --source arp" can not show correct netmask
• BZ - 1589115 - libvirt fails to chown memory snapshot on shared (NFS) storage
• BZ - 1589730 - libvirtd crashed sometimes if the guest crash on the source host at the end of migration
• BZ - 1590214 - "Failed to reserve port 65535" for guest graphic
• BZ - 1591017 - nwfilter blocks all network traffic when "clean-traffic" filter is applied to guest interface.
• BZ - 1591235 - virt-install/virsh reports 'node 0/1 not found' error when specify nodeset in memorybacking
• BZ - 1591561 - libvirtd crash when detach serial device using 'virsh detach-device-alias --config'
• BZ - 1591628 - Error occurred when revert a running domain to a running snapshot with "--force"
• BZ - 1593137 - libvirtd crashed if destroy the guest on the source host in perform phase of live migration
• BZ - 1593549 - parts of the network filter can not pass virt-xml-validate
• BZ - 1595184 - Libvirtd crashed when domifstat for interface type: user, udp
• BZ - 1597550 - libvirtd crashed when hot plug a scsi hostdev
• BZ - 1597940 - vhost-user socket path is not recognized by libvirt
• BZ - 1598015 - libvirtd crashed on target host when do migration with '--tls'
• BZ - 1598084 - cannot acquire state change lock when create snapshot with --quiesce
• BZ - 1598087 - Improve documentation description for 'virsh detach-device-alias' cmd
• BZ - 1598281 - Can NOT convert an existing guest to the native qemu-argv configuration format
• BZ - 1598311 - Error message is weird when there is no enough pci slot for hotplug interface
• BZ - 1598440 - virt-v2v will hang at opening the overlay during conversion with libvirt-4.5.0-1
• BZ - 1599545 - libvirtd crashed randomly during start
• BZ - 1599973 - libvirtd crashed during stop if there is a guest set filterref in guest vNIC
• BZ - 1600122 - Explicitly require matching libvirt-libs in driver subpackages
• BZ - 1600329 - nwfilter-binding-undefine list in virsh man page but not exists when execute
• BZ - 1600330 - The dumped filterbinding can not pass the xml validate
• BZ - 1600345 - Can not edit alias name for vsock device
• BZ - 1600427 - Guest can not get correct value of global_period when set schedinfo with --config
• BZ - 1600468 - domifaddr should not query non-existing file for interface from host bridge network
• BZ - 1601318 - Failed to define/create guest with vf as hostdev interface with boot order
• BZ - 1601377 - pool-create-as pool-define-as failed when provide --adapter-parent-wwnn and --adapter-parent-wwpn
• BZ - 1603025 - Start/Destroy/Virsh edit guest with 'iscsi block disk'/ 'bridge interface' cause libvirtd memleak
• BZ - 1603115 - Backport clean-traffic-gateway into RHEL 7.6
• BZ - 1607825 - Improve the error msg when define guest with 'none' type video and other video
• BZ - 1607831 - Error message about nwfilter promoted when fail to start vm
• BZ - 1609087 - Failed to define q35 guest with 'none' video type when pci address 0000:00:01.0 is used by other device
• BZ - 1611320 - org.libvirt.api.nwfilter-binding.create is not registered
• BZ - 1612009 - libvirtd crash when using perl-Sys-Virt API: get_node_sev_info()
• BZ - 1613746 - vol-resize with --shrink can't shrink encrypted volume
• BZ - 1618622 - Detaching ('virsh detach-device-alias') shmem returns failure while actually succeeds in dumpxml of VM
• BZ - 1621910 - virDomainUpdateDeviceFlags fails when alias is not specified
• BZ - 1623157 - Domain ABI stability check must forbid host MTU changes on NICs
• BZ - 1624735 - libvirt refuses to start a guest with vfio-ccw on s390 because of missing 'display' attribute

CVEs

• CVE-2018-6764

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index