A double free vulnerability was found in libvirt while requesting information about the network interfaces of a running domain. The flaw lies in qemuAgentGetInterfaces() in qemu/qemu_agent.c. More specifically, this function interacts with the guest agent and receives JSON data from the agent that contains network interface information. It enumerates the interfaces one by one, using a pointer to a pointers to hold a split interface name (ifname). At some point in every iteration ifname is free'd. If an error occurs right after this, there is a 'goto error', the error handler at this label will free ifname again, leading to a double free. Depending on the ability of the attacker to control and shape the heap state when the second free happens, this flaw may be exploited to achieve code execution.
Acknowledgments: Name: Ilja Van Sprundel (IOActive)
Seems like this flaw was introduced way back in libvirt v1.2.14 with the following commit: -> https://libvirt.org/git/?p=libvirt.git;a=commit;h=0977b8aa071de550e1a013d35e2c72615e65d520 As a side note, a recent update in version 6.7.0 replaced virStringListFree (responsible for freeing ifname) with g_strfreev(): -> https://libvirt.org/git/?p=libvirt.git;a=commit;h=ee247e1d3fbfcf8d2aaff9447b79a65910bcf026 This change didn't have any repercussions on the impact of this flaw, though.
Statement: Red Hat Enterprise Linux 5 and 6 are not affected by this issue as they shipped an older version of `libvirt` which did not include the vulnerable code. This flaw affects versions of the `libvirt` package as shipped with Red Hat Enterprise Linux 7 and 8 as well as Red Hat Enterprise Linux Advanced Virtualization 8. Future `libvirt` package updates for these products may address this issue.
The check in virDomainInterfaceAddresses() in libvirt-domain.c prevents read-only clients from exploiting this flaw: ``` if (source == VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT) virCheckReadOnlyGoto(dom->conn->flags, error); ``` This issue mostly involves a security boundary violation in the polkit access control driver: https://libvirt.org/aclpolkit.html. Specifically, clients connecting to the read-write socket with limited ACL permissions (i.e., read-only) could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system.
Upstream commits: * https://libvirt.org/git/?p=libvirt.git;a=commit;h=955029bd0ad7ef96000f529ac38204a8f4a96401 * https://libvirt.org/git/?p=libvirt.git;a=commit;h=50864dcda191eb35732dbd80fb6ca251a6bba923 * https://libvirt.org/git/?p=libvirt.git;a=commit;h=e4116eaa44cb366b59f7fe98f4b88d04c04970ad * https://libvirt.org/git/?p=libvirt.git;a=commit;h=a63b48c5ecef077bf0f909a85f453a605600cf05
Created libvirt tracking bugs for this issue: Affects: fedora-all [bug 1883864] Created mingw-libvirt tracking bugs for this issue: Affects: fedora-all [bug 1883865]
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:5040 https://access.redhat.com/errata/RHSA-2020:5040
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25637
This issue has been addressed in the following products: Advanced Virtualization for RHEL 8.2.1 Via RHSA-2020:5111 https://access.redhat.com/errata/RHSA-2020:5111
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1762 https://access.redhat.com/errata/RHSA-2021:1762