Memory leak in libvirt - CVE-2023-2700

 

Memory leak in libvirt - CVE-2023-2700

Published: May 31, 2023


Vulnerability identifier: #VU76721
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-2700
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak within the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup. A local user can repeatedly query an SR-IOV PCI device's capabilities to cause memory leak and perform denial of service attack.


Affected software

libvirt
Gentoo Linux
Oracle Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Server Applications Module
Basesystem Module
openSUSE Leap
Ubuntu
Fedora
Red Hat OpenShift Container Platform
OpenShift Virtualization
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
netcf
netcf-devel
netcf-libs
swtpm-tools-pkcs11
swtpm-tools
swtpm-libs
swtpm-devel
swtpm
libtpms
libtpms-devel
sgabios
sgabios-bin
libvirt-dbus
python3-hivex
ruby-hivex
perl-hivex
ocaml-hivex-devel
ocaml-hivex
hivex
hivex-devel
nbdfuse
libnbd-devel
libnbd
ocaml-libnbd
ocaml-libnbd-devel
python3-libnbd
libnbd-bash-completion
seabios-bin
seavgabios-bin
seabios
libiscsi-devel
libiscsi-utils
libiscsi
nbdkit-tar-filter
nbdkit-ssh-plugin
nbdkit-example-plugins
nbdkit-tar-plugin
nbdkit-server
nbdkit-python-plugin
nbdkit-nbd-plugin
nbdkit-linuxdisk-plugin
nbdkit-gzip-plugin
nbdkit-gzip-filter
nbdkit-tmpdisk-plugin
nbdkit-xz-filter
nbdkit-devel
nbdkit-curl-plugin
nbdkit-basic-plugins
nbdkit-bash-completion
nbdkit-basic-filters
nbdkit
nbdkit-vddk-plugin
virt-v2v-man-pages-uk
virt-v2v-man-pages-ja
virt-v2v
virt-v2v-bash-completion
ocaml-libguestfs-devel
libguestfs
libguestfs-appliance
libguestfs-devel
libguestfs-gfs2
libguestfs-gobject
libguestfs-gobject-devel
libguestfs-java
libguestfs-java-devel
libguestfs-rescue
libguestfs-rsync
libguestfs-tools-c
libguestfs-tools
ocaml-libguestfs
perl-Sys-Guestfs
python3-libguestfs
ruby-libguestfs
virt-dib
lua-guestfs
libguestfs-bash-completion
libguestfs-inspect-icons
libguestfs-javadoc
libguestfs-man-pages-ja
libguestfs-man-pages-uk
libguestfs-xfs
supermin-devel
supermin
qemu-kvm-core
qemu-kvm-block-gluster
qemu-kvm-hw-usbredir
qemu-kvm-ui-opengl
qemu-kvm-ui-spice
qemu-user-static
qemu-kvm-tests
qemu-kvm-docs
qemu-kvm-common
qemu-kvm-block-ssh
qemu-kvm-block-rbd
qemu-kvm-block-iscsi
qemu-kvm-block-curl
qemu-kvm
qemu-img
qemu-guest-agent
perl-Sys-Virt
libvirt-daemon (Ubuntu package)
libvirt-daemon-system (Ubuntu package)
libvirt0 (Ubuntu package)
python3-libvirt
libvirt-daemon-driver-secret
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage
libvirt-libs
libvirt-daemon-driver-qemu
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-network
libvirt-daemon-driver-interface
libvirt-daemon-config-nwfilter
libvirt-daemon-config-network
libvirt-daemon
libvirt-client
libvirt
libvirt-lock-sanlock
libvirt-docs
libvirt-devel
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-rbd
libvirt-wireshark
libvirt-nss
libvirt-daemon-driver-storage-scsi
libvirt-daemon-kvm
libvirt-daemon-driver-libxl
libvirt-daemon-driver-libxl-debuginfo
libvirt-daemon-xen
libvirt-devel-32bit
libvirt-client-32bit-debuginfo
libvirt-daemon-driver-lxc-debuginfo
libvirt-daemon-driver-storage-gluster-debuginfo
libvirt-daemon-hooks
libvirt-daemon-lxc
libvirt-lock-sanlock-debuginfo
libvirt-daemon-driver-lxc
libvirt-nss-debuginfo
wireshark-plugin-libvirt-debuginfo
libvirt-daemon-driver-network-debuginfo
libvirt-daemon-driver-storage-logical-debuginfo
libvirt-daemon-driver-storage-scsi-debuginfo
libvirt-daemon-driver-storage-disk-debuginfo
libvirt-daemon-driver-secret-debuginfo
libvirt-daemon-driver-storage-rbd-debuginfo
libvirt-daemon-driver-interface-debuginfo
libvirt-daemon-driver-nodedev-debuginfo
libvirt-daemon-qemu
libvirt-daemon-driver-nwfilter-debuginfo
libvirt-client-debuginfo
libvirt-doc
wireshark-plugin-libvirt
libvirt-daemon-driver-qemu-debuginfo
libvirt-daemon-driver-storage-iscsi-debuginfo
libvirt-daemon-driver-storage-mpath-debuginfo
libvirt-daemon-driver-storage-core-debuginfo
libvirt-daemon-debuginfo
libvirt-daemon-driver-storage-iscsi-direct-debuginfo
libvirt-libs-debuginfo
libvirt-debugsource
libguestfs-winsupport
libvirt (Red Hat package)
libvirt-client-qemu
libvirt-client-64bit-debuginfo
libvirt-devel-64bit
app-emulation/libvirt

How to mitigate CVE-2023-2700

Install updates from vendor's website.

libvirt - update to 9.3.0
Red Hat OpenShift Container Platform - addressed in versions 4.12.23, 4.13.5, 4.13.6
OpenShift Virtualization - update to 4.13.3
netcf - update to 0.2.8-12
netcf-devel - update to 0.2.8-12
netcf-libs - update to 0.2.8-12
swtpm-tools-pkcs11 - update to 0.7.0-4.20211109gitb79fd91
swtpm-tools - update to 0.7.0-4.20211109gitb79fd91
swtpm-libs - update to 0.7.0-4.20211109gitb79fd91
swtpm-devel - update to 0.7.0-4.20211109gitb79fd91
swtpm - update to 0.7.0-4.20211109gitb79fd91
libtpms - update to 0.9.1-2.20211126git1ff6fe1f43
libtpms-devel - update to 0.9.1-2.20211126git1ff6fe1f43
sgabios - update to 0.20170427git-3
sgabios-bin - update to 0.20170427git-3
libvirt-dbus - update to 1.3.0-2
python3-hivex - update to 1.3.18-23
ruby-hivex - update to 1.3.18-23
perl-hivex - update to 1.3.18-23
ocaml-hivex-devel - update to 1.3.18-23
ocaml-hivex - update to 1.3.18-23
hivex - update to 1.3.18-23
hivex-devel - update to 1.3.18-23
nbdfuse - update to 1.6.0-5.0.1
libnbd-devel - update to 1.6.0-5.0.1
libnbd - update to 1.6.0-5.0.1
ocaml-libnbd - update to 1.6.0-5.0.1
ocaml-libnbd-devel - update to 1.6.0-5.0.1
python3-libnbd - update to 1.6.0-5.0.1
libnbd-bash-completion - update to 1.6.0-5.0.1
seabios-bin - update to 1.16.0-3
seavgabios-bin - update to 1.16.0-3
seabios - update to 1.16.0-3
libiscsi-devel - update to 1.18.0-8.0.1
libiscsi-utils - update to 1.18.0-8.0.1
libiscsi - update to 1.18.0-8.0.1
nbdkit-tar-filter - update to 1.24.0-5
nbdkit-ssh-plugin - update to 1.24.0-5
nbdkit-example-plugins - update to 1.24.0-5
nbdkit-tar-plugin - update to 1.24.0-5
nbdkit-server - update to 1.24.0-5
nbdkit-python-plugin - update to 1.24.0-5
nbdkit-nbd-plugin - update to 1.24.0-5
nbdkit-linuxdisk-plugin - update to 1.24.0-5
nbdkit-gzip-plugin - update to 1.24.0-5
nbdkit-gzip-filter - update to 1.24.0-5
nbdkit-tmpdisk-plugin - update to 1.24.0-5
nbdkit-xz-filter - update to 1.24.0-5
nbdkit-devel - update to 1.24.0-5
nbdkit-curl-plugin - update to 1.24.0-5
nbdkit-basic-plugins - update to 1.24.0-5
nbdkit-bash-completion - update to 1.24.0-5
nbdkit-basic-filters - update to 1.24.0-5
nbdkit - update to 1.24.0-5
nbdkit-vddk-plugin - update to 1.24.0-5
virt-v2v-man-pages-uk - update to 1.42.0-22
virt-v2v-man-pages-ja - update to 1.42.0-22
virt-v2v - update to 1.42.0-22
virt-v2v-bash-completion - update to 1.42.0-22
ocaml-libguestfs-devel - update to 1.44.0-9.0.1
libguestfs - update to 1.44.0-9.0.1
libguestfs-appliance - update to 1.44.0-9.0.1
libguestfs-devel - update to 1.44.0-9.0.1
libguestfs-gfs2 - update to 1.44.0-9.0.1
libguestfs-gobject - update to 1.44.0-9.0.1
libguestfs-gobject-devel - update to 1.44.0-9.0.1
libguestfs-java - update to 1.44.0-9.0.1
libguestfs-java-devel - update to 1.44.0-9.0.1
libguestfs-rescue - update to 1.44.0-9.0.1
libguestfs-rsync - update to 1.44.0-9.0.1
libguestfs-tools-c - update to 1.44.0-9.0.1
libguestfs-tools - update to 1.44.0-9.0.1
ocaml-libguestfs - update to 1.44.0-9.0.1
perl-Sys-Guestfs - update to 1.44.0-9.0.1
python3-libguestfs - update to 1.44.0-9.0.1
ruby-libguestfs - update to 1.44.0-9.0.1
virt-dib - update to 1.44.0-9.0.1
lua-guestfs - update to 1.44.0-9.0.1
libguestfs-bash-completion - update to 1.44.0-9.0.1
libguestfs-inspect-icons - update to 1.44.0-9.0.1
libguestfs-javadoc - update to 1.44.0-9.0.1
libguestfs-man-pages-ja - update to 1.44.0-9.0.1
libguestfs-man-pages-uk - update to 1.44.0-9.0.1
libguestfs-xfs - update to 1.44.0-9.0.1
supermin-devel - update to 5.2.1-2.0.1
supermin - update to 5.2.1-2.0.1
qemu-kvm-core - update to 6.2.0-32.0.1
qemu-kvm-block-gluster - update to 6.2.0-32.0.1
qemu-kvm-hw-usbredir - update to 6.2.0-32.0.1
qemu-kvm-ui-opengl - update to 6.2.0-32.0.1
qemu-kvm-ui-spice - update to 6.2.0-32.0.1
qemu-user-static - update to 6.2.0-32.0.1
qemu-kvm-tests - update to 6.2.0-32.0.1
qemu-kvm-docs - update to 6.2.0-32.0.1
qemu-kvm-common - update to 6.2.0-32.0.1
qemu-kvm-block-ssh - update to 6.2.0-32.0.1
qemu-kvm-block-rbd - update to 6.2.0-32.0.1
qemu-kvm-block-iscsi - update to 6.2.0-32.0.1
qemu-kvm-block-curl - update to 6.2.0-32.0.1
qemu-kvm - update to 6.2.0-32.0.1
qemu-img - update to 6.2.0-32.0.1
qemu-guest-agent - update to 6.2.0-32.0.1
perl-Sys-Virt - update to 8.0.0-1
libvirt-daemon (Ubuntu package) - addressed in versions 8.0.0-1ubuntu7.5, 8.6.0-0ubuntu3.2, 9.0.0-2ubuntu1.1
libvirt-daemon-system (Ubuntu package) - addressed in versions 8.0.0-1ubuntu7.5, 8.6.0-0ubuntu3.2, 9.0.0-2ubuntu1.1
libvirt0 (Ubuntu package) - addressed in versions 8.0.0-1ubuntu7.5, 8.6.0-0ubuntu3.2, 9.0.0-2ubuntu1.1
python3-libvirt - update to 8.0.0-2
libvirt-daemon-driver-secret - update to 8.0.0-20
libvirt-daemon-driver-storage-logical - update to 8.0.0-20
libvirt-daemon-driver-storage-iscsi-direct - update to 8.0.0-20
libvirt-daemon-driver-storage-iscsi - update to 8.0.0-20
libvirt-daemon-driver-storage-gluster - update to 8.0.0-20
libvirt-daemon-driver-storage-disk - update to 8.0.0-20
libvirt-daemon-driver-storage-core - update to 8.0.0-20
libvirt-daemon-driver-storage - update to 8.0.0-20
libvirt-libs - update to 8.0.0-20
libvirt-daemon-driver-qemu - update to 8.0.0-20
libvirt-daemon-driver-nwfilter - update to 8.0.0-20
libvirt-daemon-driver-nodedev - update to 8.0.0-20
libvirt-daemon-driver-network - update to 8.0.0-20
libvirt-daemon-driver-interface - update to 8.0.0-20
libvirt-daemon-config-nwfilter - update to 8.0.0-20
libvirt-daemon-config-network - update to 8.0.0-20
libvirt-daemon - update to 8.0.0-20
libvirt-client - update to 8.0.0-20
libvirt - update to 8.0.0-20
libvirt-lock-sanlock - update to 8.0.0-20
libvirt-docs - update to 8.0.0-20
libvirt-devel - update to 8.0.0-20
libvirt-daemon-driver-storage-mpath - update to 8.0.0-20
libvirt-daemon-driver-storage-rbd - update to 8.0.0-20
libvirt-wireshark - update to 8.0.0-20
libvirt-nss - update to 8.0.0-20
libvirt-daemon-driver-storage-scsi - update to 8.0.0-20
libvirt-daemon-kvm - update to 8.0.0-20
libvirt-daemon-driver-libxl - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-devel - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-libxl-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-xen - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-devel-32bit - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-client-32bit-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-lxc-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-gluster-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-hooks - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-gluster - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-lxc - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-lock-sanlock-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-lxc - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-lock-sanlock - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-nss - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-nss-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
wireshark-plugin-libvirt-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-network-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-logical-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-interface - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-scsi-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-client - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-libs - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-disk-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-secret-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-rbd-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-config-nwfilter - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-iscsi - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-interface-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-secret - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-nodedev-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-qemu - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-nwfilter-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-nodedev - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-disk - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-client-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-mpath - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-doc - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
wireshark-plugin-libvirt - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-config-network - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-qemu-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-iscsi-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-scsi - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-core - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-qemu - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-mpath-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-iscsi-direct - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-core-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-nwfilter - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-rbd - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-iscsi-direct-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-network - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-daemon-driver-storage-logical - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-libs-debuginfo - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libvirt-debugsource - addressed in versions 8.0.0-150400.7.6.1, 9.0.0-150500.6.3.1
libguestfs-winsupport - update to 8.8-1
libvirt - update to 9.0.0-4.fc38
libvirt (Red Hat package) - update to 9.0.0-10.2.el9_2
libvirt-client-qemu - update to 9.0.0-150500.6.3.1
libvirt-client-64bit-debuginfo - update to 9.0.0-150500.6.3.1
libvirt-devel-64bit - update to 9.0.0-150500.6.3.1
app-emulation/libvirt - update to 10.2.0

External References

Related Security Bulletins