Advisories ยป MGASA-2019-0390

Updated libvirt packages fix security vulnerabilities

Publication date: 15 Dec 2019
Type: security
Affected Mageia releases : 7
CVE: CVE-2019-3886 , CVE-2019-10132 , CVE-2019-10161 , CVE-2019-10166 , CVE-2019-10167 , CVE-2019-10168


Updated libvirt packages fix security vulnerabilities:

An information leak which allowed to retrieve the guest hostname
under readonly mode (CVE-2019-3886).

Wrong permissions in systemd admin-sock due to missing SocketMode
parameter (CVE-2019-10132).

Arbitrary file read/exec via virDomainSaveImageGetXMLDesc API

virDomainManagedSaveDefineXML API exposed to readonly clients

Arbitrary command execution via virConnectGetDomainCapabilities API

Arbitrary command execution via virConnectBaselineHypervisorCPU and
virConnectCompareHypervisorCPU APIs (CVE-2019-10168).

Also, this update contains the libvirt adjustments, that pass through
the new 'md-clear' CPU flag, to help address Intel CPU speculative
execution flaws.