Bug 1977726 (CVE-2021-3631)
| Summary: | CVE-2021-3631 libvirt: Insecure sVirt label generation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | agedosier, berrange, clalancette, crobinso, eblake, jdenemar, jforbes, jsuchane, knoel, laine, libvirt-maint, pkrempa, tuxmealux+redhatbz, veillard, virt-maint, virt-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt 7.5.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-09-30 18:21:06 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1977760, 1977774, 1977775, 1977776, 1977777, 1977778, 1993309 | ||
| Bug Blocks: | 1977727, 1977735 | ||
|
Description
Mauro Matteo Cascella
2021-06-30 11:12:41 UTC
Created libvirt tracking bugs for this issue: Affects: fedora-all [bug 1977760] As noted by Daniel P. Berrangé, the impact of this flaw is minor because: 1) the probability of generating a label with the same MCS category is rather small (0.2%). 2) there needs to be another guest on the same host with a category pair, one of whose categories matches the vulnerable guest configuration. 3) the attacker needs to escape from the guest with some exploit in QEMU first. Under these circumstances this flaw will make it possible for the exploited guest to break out of sVirt confinement and impact another guest. Note that this flaw does *not* allow the exploited guest to impact the host system. This issue has been addressed in the following products: Advanced Virtualization for RHEL 8.4.0.Z Via RHSA-2021:3703 https://access.redhat.com/errata/RHSA-2021:3703 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-3631 This issue has been addressed in the following products: Advanced Virtualization for RHEL 8.2.1 Via RHSA-2021:3704 https://access.redhat.com/errata/RHSA-2021:3704 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4191 https://access.redhat.com/errata/RHSA-2021:4191 |