Race condition in libvirt - CVE-2023-3750

Vulnerability identifier: #VU78694

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-3750

CWE-ID: CWE-362

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the virStoragePoolObjListSearch() function. which does not return a locked pool as expected. A remote attacker with ability to connect to the read-only socket can crash the libvirt daemon.

libvirt
Oracle Linux
Gentoo Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Basesystem Module
Server Applications Module
openSUSE Leap
Ubuntu
Fedora
libvirt-daemon-system (Ubuntu package)
libvirt-daemon (Ubuntu package)
libvirt0 (Ubuntu package)
libvirt
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-disk
libvirt-daemon-lxc
libvirt-debugsource
libvirt-daemon-driver-storage-iscsi
wireshark-plugin-libvirt-debuginfo
libvirt-daemon-config-network
libvirt-lock-sanlock
libvirt-daemon-driver-storage-disk-debuginfo
libvirt-daemon-driver-interface
libvirt-daemon-driver-network-debuginfo
libvirt-client-debuginfo
libvirt-libs-debuginfo
libvirt-daemon-driver-network
libvirt-lock-sanlock-debuginfo
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-scsi-debuginfo
libvirt-daemon-driver-storage
libvirt-daemon-driver-lxc
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-qemu
libvirt-client-32bit-debuginfo
libvirt-daemon-xen
libvirt-daemon-driver-libxl-debuginfo
libvirt-devel-32bit
libvirt-daemon-driver-libxl
libvirt-doc
libvirt-daemon-driver-storage-rbd-debuginfo
libvirt-daemon-driver-storage-rbd
libvirt-devel-64bit
libvirt-client-64bit-debuginfo
libvirt-daemon-driver-storage-mpath-debuginfo
libvirt-daemon-driver-nwfilter
libvirt-client
libvirt-daemon
libvirt-client-qemu
libvirt-devel
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-qemu-debuginfo
libvirt-daemon-hooks
libvirt-daemon-qemu
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-interface-debuginfo
libvirt-daemon-debuginfo
wireshark-plugin-libvirt
libvirt-daemon-driver-storage-core-debuginfo
libvirt-daemon-driver-storage-gluster-debuginfo
libvirt-daemon-driver-secret
libvirt-daemon-driver-nodedev-debuginfo
libvirt-libs
libvirt-daemon-driver-lxc-debuginfo
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-logical-debuginfo
libvirt-daemon-driver-nodedev
libvirt-nss-debuginfo
libvirt-daemon-driver-secret-debuginfo
libvirt-daemon-driver-storage-iscsi-direct-debuginfo
libvirt-daemon-driver-storage-iscsi-debuginfo
libvirt-nss
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-nwfilter-debuginfo
libvirt (Red Hat package)
app-emulation/libvirt

Install updates from vendor's website.

libvirt-daemon-system (Ubuntu package) - update to 9.0.0-2ubuntu1.2
libvirt-daemon (Ubuntu package) - update to 9.0.0-2ubuntu1.2
libvirt0 (Ubuntu package) - update to 9.0.0-2ubuntu1.2
libvirt - update to 9.0.0-4.fc38
libvirt-daemon-driver-storage-iscsi-direct - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-disk - update to 9.0.0-150500.6.11.1
libvirt-daemon-lxc - update to 9.0.0-150500.6.11.1
libvirt-debugsource - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-iscsi - update to 9.0.0-150500.6.11.1
wireshark-plugin-libvirt-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-config-network - update to 9.0.0-150500.6.11.1
libvirt-lock-sanlock - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-disk-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-interface - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-network-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-client-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-libs-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-network - update to 9.0.0-150500.6.11.1
libvirt-lock-sanlock-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-gluster - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-scsi-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-lxc - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-mpath - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-qemu - update to 9.0.0-150500.6.11.1
libvirt-client-32bit-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-xen - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-libxl-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-devel-32bit - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-libxl - update to 9.0.0-150500.6.11.1
libvirt-doc - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-rbd-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-rbd - update to 9.0.0-150500.6.11.1
libvirt-devel-64bit - update to 9.0.0-150500.6.11.1
libvirt-client-64bit-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-mpath-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-nwfilter - update to 9.0.0-150500.6.11.1
libvirt-client - update to 9.0.0-150500.6.11.1
libvirt - update to 9.0.0-150500.6.11.1
libvirt-daemon - update to 9.0.0-150500.6.11.1
libvirt-client-qemu - update to 9.0.0-150500.6.11.1
libvirt-devel - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-core - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-qemu-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-hooks - update to 9.0.0-150500.6.11.1
libvirt-daemon-qemu - update to 9.0.0-150500.6.11.1
libvirt-daemon-config-nwfilter - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-interface-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-debuginfo - update to 9.0.0-150500.6.11.1
wireshark-plugin-libvirt - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-core-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-gluster-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-secret - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-nodedev-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-libs - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-lxc-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-scsi - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-logical-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-nodedev - update to 9.0.0-150500.6.11.1
libvirt-nss-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-secret-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-iscsi-direct-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-iscsi-debuginfo - update to 9.0.0-150500.6.11.1
libvirt-nss - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-storage-logical - update to 9.0.0-150500.6.11.1
libvirt-daemon-driver-nwfilter-debuginfo - update to 9.0.0-150500.6.11.1
libvirt (Red Hat package) - update to 9.5.0-7.el9_3
app-emulation/libvirt - update to 10.2.0

• https://bugzilla.redhat.com/show_bug.cgi?id=2222210

• Denial of service in libvirt
• Ubuntu update for libvirt
• SUSE update for libvirt
• Red Hat Enterprise Linux 9 update for libvirt
• Multiple vulnerabilities in Oracle Linux
• Fedora 38 update for libvirt
• Gentoo update for libvirt