libvirt_lxc resolves a host name after the guest filesystem is mounted but before the init from it is executed. That in turn causes glibc to load libnss_dns.so and it ends up being loaded from the guest tree, making it possible for the guest to inject executable code before the host filesystem is umounted and file handles closed. That has potential security implications.
Created libvirt tracking bugs for this issue:
Affects: fedora-all [bug 1542815]
Created mingw-libvirt tracking bugs for this issue:
Affects: fedora-all [bug 1542814]
Upsptream fix is in git as:
Author: Lubomir Rintel <firstname.lastname@example.org>
Date: Sat Jan 27 23:43:58 2018 +0100
virlog: determine the hostname on startup CVE-2018-6764
At later point it might not be possible or even safe to use getaddrinfo(). It
can in turn result in a load of NSS module.
Notably, on a LXC container startup we may find ourselves with the guest
filesystem already having replaced the host one. Loading a NSS module
from the guest tree would allow a malicous guest to escape the
confinement of its container environment because libvirt will not yet
have locked it down.
libvirt-3.7.0-4.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:3113 https://access.redhat.com/errata/RHSA-2018:3113