Bug 1138305 (CVE-2019-10168) - VUL-0: CVE-2019-10168: libvirt: api: disallow virConnect*HypervisorCPU on read-only connections
Summary: VUL-0: CVE-2019-10168: libvirt: api: disallow virConnect*HypervisorCPU on rea...
Status: RESOLVED FIXED
Alias: CVE-2019-10168
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/235186/
Whiteboard: CVSSv3:SUSE:CVE-2019-10168:7.8:(AV:L/...
Keywords:
Depends on:
Blocks:
 
Reported: 2019-06-14 13:43 UTC by Marcus Meissner
Modified: 2019-07-20 10:10 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
CVE-2019-10168.patch (1.10 KB, patch)
2019-06-14 13:44 UTC, Marcus Meissner
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2019-06-14 13:43:48 UTC
via libvirt security, reported by Matthias

These APIs can be used to execute arbitrary emulators.                                                                                                                                       
Forbid them on read-only connections.                                                                                                                                                        
                                                                                                                                                                                             
Fixes: CVE-2019-10168                                                                                                                                                                        
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Comment 1 Marcus Meissner 2019-06-14 13:44:10 UTC
Created attachment 807637 [details]
CVE-2019-10168.patch

CVE-2019-10168.patch
Comment 2 James Fehlig 2019-06-14 21:55:17 UTC
This bug affects SLE12 SP5, SLE15 SP1, and TW.
Comment 3 Marcus Meissner 2019-06-17 11:51:03 UTC
CRD: 2019-06-20 12:00UTC
Comment 6 Swamp Workflow Management 2019-06-20 17:40:18 UTC
This is an autogenerated message for OBS integration:
This bug (1138305) was mentioned in
https://build.opensuse.org/request/show/711170 Factory / libvirt
Comment 7 Swamp Workflow Management 2019-06-21 16:16:31 UTC
SUSE-SU-2019:1643-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1138301,1138302,1138303,1138305
CVE References: CVE-2019-10161,CVE-2019-10166,CVE-2019-10167,CVE-2019-10168
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP1 (src):    libvirt-5.1.0-8.6.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    libvirt-5.1.0-8.6.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    libvirt-5.1.0-8.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Alexandros Toptsoglou 2019-06-21 16:19:26 UTC
is public now
Comment 9 James Fehlig 2019-07-01 16:14:51 UTC
I think this one can be closed as well. The fix has been released for SLE15 SP1 and Factory, and I've submitted it for next SLE12 SP5 milestone.
Comment 11 Marcus Meissner 2019-07-02 05:02:35 UTC
done
Comment 12 Swamp Workflow Management 2019-07-20 10:10:51 UTC
openSUSE-SU-2019:1753-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1138301,1138302,1138303,1138305
CVE References: CVE-2019-10161,CVE-2019-10166,CVE-2019-10167,CVE-2019-10168
Sources used:
openSUSE Leap 15.1 (src):    libvirt-5.1.0-lp151.7.3.1