Ubuntu 5399-1: libvirt vulnerabilities | LinuxSecurity.com
==========================================================================
Ubuntu Security Notice USN-5399-1
May 02, 2022

libvirt vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 21.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in libvirt.

Software Description:
- libvirt: Libvirt virtualization toolkit

Details:

It was discovered that libvirt incorrectly handled certain locking
operations. A local attacker could possibly use this issue to cause libvirt
to stop accepting connections, resulting in a denial of service. This issue
only affected Ubuntu 20.04 LTS. (CVE-2021-3667)

It was discovered that libvirt incorrectly handled threads during shutdown.
A local attacker could possibly use this issue to cause libvirt to crash,
resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS
and Ubuntu 20.04 LTS. (CVE-2021-3975)

It was discovered that libvirt incorrectly handled the libxl driver. An
attacker inside a guest could possibly use this issue to cause libvirtd
to crash or stop responding, resulting in a denial of service. This issue
only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10.
(CVE-2021-4147)

It was discovered that libvirt incorrectly handled the nwfilter driver. A
local attacker could possibly use this issue to cause libvirt to crash,
resulting in a denial of service. (CVE-2022-0897)

It was discovered that libvirt incorrectly handled the polkit access
control driver. A local attacker could possibly use this issue to cause
libvirt to crash, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-25637)

It was discovered that libvirt incorrectly generated SELinux labels. In
environments using SELinux, this issue could allow the sVirt confinement
to be bypassed. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04
LTS. (CVE-2021-3631)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  libvirt-daemon                  7.6.0-0ubuntu1.2
  libvirt-daemon-system           7.6.0-0ubuntu1.2
  libvirt0                        7.6.0-0ubuntu1.2

Ubuntu 20.04 LTS:
  libvirt-daemon                  6.0.0-0ubuntu8.16
  libvirt-daemon-system           6.0.0-0ubuntu8.16
  libvirt0                        6.0.0-0ubuntu8.16

Ubuntu 18.04 LTS:
  libvirt-daemon                  4.0.0-1ubuntu8.21
  libvirt-daemon-system           4.0.0-1ubuntu8.21
  libvirt0                        4.0.0-1ubuntu8.21

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5399-1
  CVE-2020-25637, CVE-2021-3631, CVE-2021-3667, CVE-2021-3975,
  CVE-2021-4147, CVE-2022-0897

Package Information:
  https://launchpad.net/ubuntu/+source/libvirt/7.6.0-0ubuntu1.2
  https://launchpad.net/ubuntu/+source/libvirt/6.0.0-0ubuntu8.16
  https://launchpad.net/ubuntu/+source/libvirt/4.0.0-1ubuntu8.21

Ubuntu 5399-1: libvirt vulnerabilities

May 2, 2022

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in libvirt. Software Description: - libvirt: Libvirt virtualization toolkit Details: It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvirt to stop accepting connections, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3667) It was discovered that libvirt incorrectly handled threads during shutdown. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3975) It was discovered that libvirt incorrectly handled the libxl driver. An attacker inside a guest could possibly use this issue to cause libvirtd to crash or stop responding, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2021-4147) It was discovered that libvirt incorrectly handled the nwfilter driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2022-0897) It was discovered that libvirt incorrectly handled the polkit access control driver. A local attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-25637) It was discovered that libvirt incorrectly generated SELinux labels. In environments using SELinux, this issue could allow the sVirt confinement to be bypassed. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-3631)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: libvirt-daemon 7.6.0-0ubuntu1.2 libvirt-daemon-system 7.6.0-0ubuntu1.2 libvirt0 7.6.0-0ubuntu1.2 Ubuntu 20.04 LTS: libvirt-daemon 6.0.0-0ubuntu8.16 libvirt-daemon-system 6.0.0-0ubuntu8.16 libvirt0 6.0.0-0ubuntu8.16 Ubuntu 18.04 LTS: libvirt-daemon 4.0.0-1ubuntu8.21 libvirt-daemon-system 4.0.0-1ubuntu8.21 libvirt0 4.0.0-1ubuntu8.21 After a standard system update you need to reboot your computer to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5399-1

CVE-2020-25637, CVE-2021-3631, CVE-2021-3667, CVE-2021-3975,

CVE-2021-4147, CVE-2022-0897

Severity
Ubuntu Security Notice USN-5399-1

Package Information

https://launchpad.net/ubuntu/+source/libvirt/7.6.0-0ubuntu1.2 https://launchpad.net/ubuntu/+source/libvirt/6.0.0-0ubuntu8.16 https://launchpad.net/ubuntu/+source/libvirt/4.0.0-1ubuntu8.21

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.