Bug 1503658 (CVE-2017-1000256)

Summary: CVE-2017-1000256 libvirt: TLS certificate verification disabled for clients
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: agedosier, berrange, bmcclain, cfergeau, clalancette, crobinso, dblechte, dzheng, eblake, eedri, erik-fedora, fjin, itamar, jdenemar, jforbes, jsuchane, knoel, laine, libvirt-maint, lsurette, marcandre.lureau, mgoldboi, michal.skrivanek, pkrempa, rh-spice-bugs, rjones, sherold, sisharma, srevivo, ssaha, vbellur, veillard, ykaul
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:29:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1503687, 1503688    
Bug Blocks: 1502737    

Description Andrej Nemec 2017-10-18 14:23:30 UTC 
The default_tls_x509_verify (and related) parameters in qemu.conf
control whether the TLS servers in QEMU request & verify
certificates from clients. This works as a simple access control
system for QEMU servers by requiring the CA to issue certs to
permitted clients. This use of client certificates is disabled by
default, since it requires extra work to issue client certificates.
Unfortunately the libvirt code was using these configuration
parameters when setting up both TLS clients and servers in QEMU. The
result was that TLS clients for character devices and disk devices
had verification turned off, meaning they would ignore any errors
while validating the server certificate.

A MITM attacker can attack any client connection made by QEMU's
character devices and disk devices which have TLS enabled. The
attacker can send an arbitrary certificate back to the client QEMU
and it will ignore all errors that result during validation.

References:

https://www.redhat.com/archives/libvirt-announce/2017-October/msg00001.html
Comment 1 Andrej Nemec 2017-10-18 14:23:32 UTC 
Acknowledgments:

Name: Daniel P. Berrange (Red Hat)
Comment 2 Andrej Nemec 2017-10-18 14:36:49 UTC 
Created libvirt tracking bugs for this issue:

Affects: fedora-all [bug 1503687]


Created mingw-libvirt tracking bugs for this issue:

Affects: fedora-all [bug 1503688]
Comment 4 Fedora Update System 2017-12-12 11:24:34 UTC 
libvirt-3.7.0-3.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2018-01-03 21:17:28 UTC 
libvirt-3.2.1-7.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.