UbuntuUpdates.org

Package "libvirt"

Name: libvirt

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • nss plugin providing IP add ress resolution for virtual machines
  • Virtualization daemon glusterfs storage driver
  • Virtualization daemon Sheedog storage driver
  • Virtualization daemon ZFS storage driver

Latest version: 4.0.0-1ubuntu8.21
Release: bionic (18.04)
Level: security
Repository: universe

Links



Other versions of "libvirt" in Bionic

Repository Area Version
base main 4.0.0-1ubuntu8
base universe 4.0.0-1ubuntu8
security main 4.0.0-1ubuntu8.21
updates universe 4.0.0-1ubuntu8.21
updates main 4.0.0-1ubuntu8.21

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 4.0.0-1ubuntu8.21 2022-05-02 18:06:23 UTC

  libvirt (4.0.0-1ubuntu8.21) bionic-security; urgency=medium

  * SECURITY UPDATE: crash via double-free memory issue
    - debian/patches/CVE-2020-25637-1.patch: gendispatch: handle empty
      flags in src/rpc/gendispatch.pl.
    - debian/patches/CVE-2020-25637-2.patch: add support for filtering
      @acls by uint params in src/remote/remote_protocol.x,
      src/rpc/gendispatch.pl.
    - debian/patches/CVE-2020-25637-3.patch: require write acl for guest
      agent in src/libxl/libxl_driver.c, src/qemu/qemu_driver.c,
      src/remote/remote_protocol.x.
    - debian/patches/CVE-2020-25637-4.patch: set ifname to NULL after
      freeing in src/qemu/qemu_agent.c.
    - CVE-2020-25637
  * SECURITY UPDATE: sVirt SELinux confinement flaw
    - debian/patches/CVE-2021-3631.patch: fix SELinux label generation
      logic in src/security/security_selinux.c.
    - CVE-2021-3631
  * SECURITY UPDATE: segmentation fault during VM shutdown
    - debian/patches/CVE-2021-3975.patch: add missing lock in
      qemuProcessHandleMonitorEOF in src/qemu/qemu_process.c.
    - CVE-2021-3975
  * SECURITY UPDATE: DoS via libxl driver
    - debian/patches/CVE-2021-4147-pre0.patch: handle external domain
      destroy in src/libxl/libxl_domain.c, src/libxl/libxl_domain.h.
    - debian/patches/CVE-2021-4147-pre1.patch: fix domain shutdown in
      src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-1.patch: disable death events after
      receiving a shutdown event in src/libxl/libxl_domain.c,
      src/libxl/libxl_domain.h.
    - debian/patches/CVE-2021-4147-2.patch: rename libxlShutdownThreadInfo
      struct in src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-3.patch: modify name of shutdown thread
      in src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-4.patch: handle domain death events in a
      thread in src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-5.patch: search for virDomainObj in
      event handler threads in src/libxl/libxl_domain.c.
    - debian/patches/CVE-2021-4147-6pre1.patch: avoid virHashFree by
      rearranging code in src/libxl/libxl_logger.c.
    - debian/patches/CVE-2021-4147-6.patch: protect access to libxlLogger
      files hash table in src/libxl/libxl_logger.c.
    - CVE-2021-4147
  * SECURITY UPDATE: DoS via nwfilter driver
    - debian/patches/CVE-2022-0897.patch: fix crash when counting number of
      network filters in src/nwfilter/nwfilter_driver.c.
    - CVE-2022-0897

 -- Marc Deslauriers <email address hidden> Wed, 20 Apr 2022 13:18:06 -0400

Source diff to previous version
CVE-2020-25637 A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network inte
CVE-2021-3631 A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access fil
CVE-2021-3975 segmentation fault during VM shutdown can lead to vdsm hung
CVE-2021-4147 A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash,
CVE-2022-0897 A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the `driver->nwfilters` mutex before i

Version: 4.0.0-1ubuntu8.17 2020-05-21 18:06:39 UTC

  libvirt (4.0.0-1ubuntu8.17) bionic-security; urgency=medium

  * SECURITY UPDATE: denial of service via active pool without target path
    - debian/patches/ubuntu/CVE-2020-10703.patch: fix daemon crash on
      lookup storagepool by targetpath in src/storage/storage_driver.c.
    - CVE-2020-10703

 -- Marc Deslauriers <email address hidden> Wed, 06 May 2020 14:18:23 -0400

Source diff to previous version
CVE-2020-10703 Potential denial of service via active pool without target path

Version: 4.0.0-1ubuntu8.12 2019-07-08 13:08:02 UTC

  libvirt (4.0.0-1ubuntu8.12) bionic-security; urgency=medium

  * SECURITY UPDATE: virDomainSaveImageGetXMLDesc does not check for
    read-only connection
    - debian/patches/CVE-2019-10161.patch: add check to
      src/libvirt-domain.c, src/qemu/qemu_driver.c,
      src/remote/remote_protocol.x.
    - CVE-2019-10161
  * SECURITY UPDATE: virDomainManagedSaveDefineXML does not check for
    read-only connection
    - debian/patches/CVE-2019-10166.patch: add check to
      src/libvirt-domain.c.
    - CVE-2019-10166
  * SECURITY UPDATE: virConnectGetDomainCapabilities does not check for
    read-only connection
    - debian/patches/CVE-2019-10167.patch: add check to
      src/libvirt-domain.c.
    - CVE-2019-10167

 -- Marc Deslauriers <email address hidden> Tue, 02 Jul 2019 09:19:33 -0400

Source diff to previous version
CVE-2019-10161 arbitrary file read/exec via virDomainSaveImageGetXMLDesc API
CVE-2019-10166 virDomainManagedSaveDefineXML API exposed to readonly clients
CVE-2019-10167 arbitrary command execution via virConnectGetDomainCapabilities API

Version: 4.0.0-1ubuntu8.10 2019-05-15 19:07:16 UTC

  libvirt (4.0.0-1ubuntu8.10) bionic-security; urgency=medium

  * SECURITY UPDATE: Add support for md-clear functionality
    - debian/patches/md-clear.patch: Define md-clear CPUID bit in
      src/cpu/cpu_map.xml.
    - CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091

 -- Marc Deslauriers <email address hidden> Tue, 14 May 2019 15:11:45 -0400

Source diff to previous version
CVE-2018-12126 MSBDS Microarchitectural Store Buffer Data Sampling
CVE-2018-12127 MLPDS Microarchitectural Load Port Data Sampling
CVE-2018-12130 MFBDS Microarchitectural Fill Buffer Data Sampling
CVE-2019-11091 MDSUM Microarchitectural Data Sampling Uncacheable Memory

Version: 4.0.0-1ubuntu8.8 2019-03-14 19:06:57 UTC

  libvirt (4.0.0-1ubuntu8.8) bionic-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference in qemuAgentGetInterfaces
    - debian/patches/CVE-2019-3840.patch: require a reply in
      src/qemu/qemu_agent.c.
    - CVE-2019-3840

 -- Marc Deslauriers <email address hidden> Wed, 13 Mar 2019 08:09:33 -0400

CVE-2019-3840 NULL pointer dereference after running qemuAgentCommand in qemuAgentGetInterfaces function



About   -   Send Feedback to @ubuntu_updates