SUSE update for libvirt

1) Incorrect permission assignment for critical resource

EUVDB-ID: #VU62735

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3631

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to an error in the way SELinux MCS category pairs for VMs' dynamic labels in security/security_selinux.c. An attacker with access to the guest OS can access files labeled for another guest.

Mitigation

Update the affected package libvirt to the latest version.

Vulnerable software versions

SUSE MicroOS: 5.0

SUSE Linux Enterprise Module for Server Applications: 15-SP2

SUSE Linux Enterprise Module for Basesystem: 15-SP2

libvirt-daemon-xen: before 6.0.0-13.16.2

libvirt-daemon-driver-libxl-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-libxl: before 6.0.0-13.16.2

libvirt-doc: before 6.0.0-13.16.2

libvirt-bash-completion: before 6.0.0-13.16.2

libvirt-nss-debuginfo: before 6.0.0-13.16.2

libvirt-nss: before 6.0.0-13.16.2

libvirt-lock-sanlock-debuginfo: before 6.0.0-13.16.2

libvirt-lock-sanlock: before 6.0.0-13.16.2

libvirt-devel: before 6.0.0-13.16.2

libvirt-daemon-lxc: before 6.0.0-13.16.2

libvirt-daemon-hooks: before 6.0.0-13.16.2

libvirt-daemon-driver-lxc-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-lxc: before 6.0.0-13.16.2

libvirt-daemon-config-nwfilter: before 6.0.0-13.16.2

libvirt-daemon-config-network: before 6.0.0-13.16.2

libvirt-client-debuginfo: before 6.0.0-13.16.2

libvirt-client: before 6.0.0-13.16.2

libvirt-admin-debuginfo: before 6.0.0-13.16.2

libvirt-admin: before 6.0.0-13.16.2

libvirt: before 6.0.0-13.16.2

libvirt-libs-debuginfo: before 6.0.0-13.16.2

libvirt-libs: before 6.0.0-13.16.2

libvirt-debugsource: before 6.0.0-13.16.2

libvirt-daemon-qemu: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-scsi-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-scsi: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-rbd-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-rbd: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-mpath-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-mpath: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-logical-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-logical: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-iscsi-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-iscsi: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-disk-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-disk: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-core-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-storage-core: before 6.0.0-13.16.2

libvirt-daemon-driver-storage: before 6.0.0-13.16.2

libvirt-daemon-driver-secret-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-secret: before 6.0.0-13.16.2

libvirt-daemon-driver-qemu-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-qemu: before 6.0.0-13.16.2

libvirt-daemon-driver-nwfilter-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-nwfilter: before 6.0.0-13.16.2

libvirt-daemon-driver-nodedev-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-nodedev: before 6.0.0-13.16.2

libvirt-daemon-driver-network-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-network: before 6.0.0-13.16.2

libvirt-daemon-driver-interface-debuginfo: before 6.0.0-13.16.2

libvirt-daemon-driver-interface: before 6.0.0-13.16.2

libvirt-daemon-debuginfo: before 6.0.0-13.16.2

libvirt-daemon: before 6.0.0-13.16.2

CPE2.3

• cpe:2.3:o:suse:suse_microos:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_server_applications:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:a:suse:libvirt-daemon-xen:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-libxl-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-libxl:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-doc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-bash-completion:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-nss-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-nss:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-lock-sanlock-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-lock-sanlock:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-lxc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-hooks:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-lxc-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-lxc:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-config-nwfilter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-config-network:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-client-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-client:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-admin-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-admin:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-libs-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-libs:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-qemu:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-scsi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-scsi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-rbd-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-rbd:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-mpath-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-mpath:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-logical-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-logical:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-iscsi-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-iscsi:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-disk-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-disk:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-core-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage-core:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-storage:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-secret-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-secret:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-qemu-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-qemu:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-nwfilter-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-nwfilter:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-nodedev-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-nodedev:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-network-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-network:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-interface-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-driver-interface:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:libvirt-daemon:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212471-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.