Bug 820397 - VUL-0: libvirt: CVE-2013-1962: DoS (max count of open files exhaustion) due sockets leak in the storage pool
VUL-0: libvirt: CVE-2013-1962: DoS (max count of open files exhaustion) due s...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
maint:running:52533:moderate
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-05-17 09:51 UTC by Alexander Bergmann
Modified: 2013-07-18 09:24 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
upstream fix for CVE-2013-1962 (991 bytes, patch)
2013-05-17 09:57 UTC, Alexander Bergmann
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2013-05-17 09:51:28 UTC
Public via oss-security:

Date: Thu, 16 May 2013 16:50:13 +0200
From: Petr Matousek
Subject: [oss-security] CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool

A denial of service flaw was found in the way storage pool manager of
libvirt, a C toolkit to interact with the virtualization capabilities of
recent versions of Linux (and other OSes), performed management of
socket file descriptors when 'to list all volumes for the particular
pool' request was issued (two socket file descriptors were leaked per
"list all pool volumes" request). An uprivileged user could use this
flaw to cause denial of service (make libvirtd daemon to exhaust / reach
the maximum count of open file descriptors, the libvirtd daemon process
was allowed to open, possibly preventing other users from use of
libvirtd services till the libvirtd daemon was restarted).

References:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1962

Upstream patch:
https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html
Comment 1 Alexander Bergmann 2013-05-17 09:55:34 UTC
Upstream patch:

https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html
Comment 2 Alexander Bergmann 2013-05-17 09:57:34 UTC
Created attachment 539792 [details]
upstream fix for CVE-2013-1962
Comment 3 Alexander Bergmann 2013-05-17 11:40:21 UTC
Only SLE11 is affected. So we need submissions for SLE11-SP1 and SP2.

The "Internal driver API for storage management" was introduced with libvirt version v0.4.1. SLE10 is using version 0.3.3.
Comment 4 Swamp Workflow Management 2013-05-17 12:10:16 UTC
The SWAMPID for this issue is 52533.
This issue was rated as moderate.
Please submit fixed packages until 2013-05-31.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 5 Alexander Bergmann 2013-05-17 12:17:23 UTC
Hello Jim, please include fixes for the following bugs, listed on the planed update list:

bnc#817008 - Regression: vm-install fails to display on SLES 11 SP2 UV2000
bnc#766559 - VUL-1: libvirt: address bus=device= when identicle vendor ID/product IDs usb devices attached are ignored
Comment 6 Swamp Workflow Management 2013-05-17 22:00:10 UTC
bugbot adjusting priority
Comment 7 Bernhard Wiedemann 2013-05-18 16:00:49 UTC
This is an autogenerated message for OBS integration:
This bug (820397) was mentioned in
https://build.opensuse.org/request/show/176049 Factory / libvirt
Comment 8 James Fehlig 2013-05-18 16:03:25 UTC
This bug only affects SLES11 SP3, openSUSE12.3, and openSUSE Factory.  The fix plugs a leak in StoragePoolListAllVolumes(), which was introduced in libvirt 0.10.2.

I'll submit a new libvirt package for SP3 GA containing the patch.

For Factory, new package has been submitted - SR#176049.

For 12.3, a maintenancerequest was submitted - SR#176052.
Comment 9 James Fehlig 2013-05-18 16:11:09 UTC
(In reply to comment #5)
> bnc#817008 - Regression: vm-install fails to display on SLES 11 SP2 UV2000

This one can be included in an SP2 update, but an SP2 update is not needed for this CVE.

> bnc#766559 - VUL-1: libvirt: address bus=device= when identicle vendor
> ID/product IDs usb devices attached are ignored

I'll have to take a look at this bug again, but IIRC fixing it in SP2 (libvirt 0.9.6) could be rather risky since this particular area of code has underwent a lot of churn.  Given the low priority, is it possible to ignore the bug for 12.1 and SP2?
Comment 10 Bernhard Wiedemann 2013-05-18 17:00:31 UTC
This is an autogenerated message for OBS integration:
This bug (820397) was mentioned in
https://build.opensuse.org/request/show/176052 Maintenance /
Comment 11 Alexander Bergmann 2013-05-21 09:11:58 UTC
As no enterprise update is needed - Closing SWAMP.
Comment 12 James Fehlig 2013-05-21 14:03:07 UTC
Ok, all is done here from my side.  Passing to security...
Comment 14 Swamp Workflow Management 2013-06-10 09:10:10 UTC
openSUSE-SU-2013:0885-1: An update that solves one vulnerability and has one errata is now available.

Category: security (moderate)
Bug References: 810893,820397
CVE References: CVE-2013-1962
Sources used:
openSUSE 12.3 (src):    libvirt-1.0.2-1.6.1
Comment 15 Marcus Meissner 2013-07-18 09:24:56 UTC
i think its done here.

sp2 will not be fixed