Security update for libvirt SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:1455-1 Final 1 1 2020-09-19T12:20:52Z current 2020-09-19T12:20:52Z 2020-09-19T12:20:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libvirt This update for libvirt fixes the following issues: - CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. bsc#1161883, bsc#1174458 This update was imported from the SUSE:SLE-15-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-1455 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6YSRCTTQNE77LHQRZYURTMQLH7NRI2LT/ E-Mail link for openSUSE-SU-2020:1455-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1161883 SUSE Bug 1161883 https://bugzilla.suse.com/1174458 SUSE Bug 1174458 https://www.suse.com/security/cve/CVE-2020-14339/ SUSE CVE CVE-2020-14339 page openSUSE Leap 15.2 libvirt-6.0.0-lp152.9.3.1 libvirt-admin-6.0.0-lp152.9.3.1 libvirt-bash-completion-6.0.0-lp152.9.3.1 libvirt-client-6.0.0-lp152.9.3.1 libvirt-daemon-6.0.0-lp152.9.3.1 libvirt-daemon-config-network-6.0.0-lp152.9.3.1 libvirt-daemon-config-nwfilter-6.0.0-lp152.9.3.1 libvirt-daemon-driver-interface-6.0.0-lp152.9.3.1 libvirt-daemon-driver-libxl-6.0.0-lp152.9.3.1 libvirt-daemon-driver-lxc-6.0.0-lp152.9.3.1 libvirt-daemon-driver-network-6.0.0-lp152.9.3.1 libvirt-daemon-driver-nodedev-6.0.0-lp152.9.3.1 libvirt-daemon-driver-nwfilter-6.0.0-lp152.9.3.1 libvirt-daemon-driver-qemu-6.0.0-lp152.9.3.1 libvirt-daemon-driver-secret-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-core-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-disk-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-gluster-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-iscsi-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-logical-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-mpath-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-rbd-6.0.0-lp152.9.3.1 libvirt-daemon-driver-storage-scsi-6.0.0-lp152.9.3.1 libvirt-daemon-hooks-6.0.0-lp152.9.3.1 libvirt-daemon-lxc-6.0.0-lp152.9.3.1 libvirt-daemon-qemu-6.0.0-lp152.9.3.1 libvirt-daemon-xen-6.0.0-lp152.9.3.1 libvirt-devel-6.0.0-lp152.9.3.1 libvirt-devel-32bit-6.0.0-lp152.9.3.1 libvirt-doc-6.0.0-lp152.9.3.1 libvirt-libs-6.0.0-lp152.9.3.1 libvirt-lock-sanlock-6.0.0-lp152.9.3.1 libvirt-nss-6.0.0-lp152.9.3.1 wireshark-plugin-libvirt-6.0.0-lp152.9.3.1 libvirt-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-admin-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-bash-completion-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-client-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-config-network-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-config-nwfilter-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-interface-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-libxl-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-lxc-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-network-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-nodedev-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-nwfilter-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-qemu-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-secret-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-core-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-disk-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-gluster-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-iscsi-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-logical-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-mpath-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-rbd-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-driver-storage-scsi-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-hooks-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-lxc-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-qemu-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-daemon-xen-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-devel-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-devel-32bit-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-doc-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-libs-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-lock-sanlock-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 libvirt-nss-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 wireshark-plugin-libvirt-6.0.0-lp152.9.3.1 as a component of openSUSE Leap 15.2 A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2020-14339 openSUSE Leap 15.2:libvirt-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-admin-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-bash-completion-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-client-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-config-network-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-config-nwfilter-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-interface-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-libxl-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-lxc-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-network-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-nodedev-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-nwfilter-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-qemu-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-secret-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-core-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-disk-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-gluster-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-iscsi-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-logical-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-mpath-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-rbd-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-driver-storage-scsi-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-hooks-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-lxc-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-qemu-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-daemon-xen-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-devel-32bit-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-devel-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-doc-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-libs-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-lock-sanlock-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:libvirt-nss-6.0.0-lp152.9.3.1 openSUSE Leap 15.2:wireshark-plugin-libvirt-6.0.0-lp152.9.3.1 important 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6YSRCTTQNE77LHQRZYURTMQLH7NRI2LT/ https://www.suse.com/security/cve/CVE-2020-14339.html CVE-2020-14339 https://bugzilla.suse.com/1174458 SUSE Bug 1174458