Security update for libvirt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2269-1 Final 1 1 2020-08-18T13:53:53Z current 2020-08-18T13:53:53Z 2020-08-18T13:53:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libvirt This update for libvirt fixes the following issues: - CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. bsc#1161883, bsc#1174458 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sles/15.2/virt-handler:0.38.1-2020-2269,Container suse/sles/15.2/virt-launcher:0.38.1-2020-2269,Image SLES15-SP2-SAP-Azure-2020-2269,Image SLES15-SP2-SAP-BYOS-Azure-2020-2269,Image SLES15-SP2-SAP-BYOS-EC2-HVM-2020-2269,Image SLES15-SP2-SAP-BYOS-GCE-2020-2269,Image SLES15-SP2-SAP-EC2-HVM-2020-2269,Image SLES15-SP2-SAP-GCE-2020-2269,SUSE-2020-2269,SUSE-SLE-Module-Basesystem-15-SP2-2020-2269,SUSE-SLE-Module-Server-Applications-15-SP2-2020-2269 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202269-1/ Link for SUSE-SU-2020:2269-1 https://lists.suse.com/pipermail/sle-security-updates/2020-August/007278.html E-Mail link for SUSE-SU-2020:2269-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1161883 SUSE Bug 1161883 https://bugzilla.suse.com/1174458 SUSE Bug 1174458 https://www.suse.com/security/cve/CVE-2020-14339/ SUSE CVE CVE-2020-14339 page Container suse/sles/15.2/virt-handler:0.38.1 Container suse/sles/15.2/virt-launcher:0.38.1 Image SLES15-SP2-SAP-Azure Image SLES15-SP2-SAP-BYOS-Azure Image SLES15-SP2-SAP-BYOS-EC2-HVM Image SLES15-SP2-SAP-BYOS-GCE Image SLES15-SP2-SAP-EC2-HVM Image SLES15-SP2-SAP-GCE SUSE Linux Enterprise Module for Basesystem 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-client-6.0.0-13.3.1 libvirt-libs-6.0.0-13.3.1 libvirt-daemon-6.0.0-13.3.1 libvirt-daemon-driver-interface-6.0.0-13.3.1 libvirt-daemon-driver-network-6.0.0-13.3.1 libvirt-daemon-driver-nodedev-6.0.0-13.3.1 libvirt-daemon-driver-nwfilter-6.0.0-13.3.1 libvirt-daemon-driver-qemu-6.0.0-13.3.1 libvirt-daemon-driver-secret-6.0.0-13.3.1 libvirt-daemon-driver-storage-6.0.0-13.3.1 libvirt-daemon-driver-storage-core-6.0.0-13.3.1 libvirt-daemon-driver-storage-disk-6.0.0-13.3.1 libvirt-daemon-driver-storage-iscsi-6.0.0-13.3.1 libvirt-daemon-driver-storage-logical-6.0.0-13.3.1 libvirt-daemon-driver-storage-mpath-6.0.0-13.3.1 libvirt-daemon-driver-storage-rbd-6.0.0-13.3.1 libvirt-daemon-driver-storage-scsi-6.0.0-13.3.1 libvirt-daemon-qemu-6.0.0-13.3.1 libvirt-6.0.0-13.3.1 libvirt-admin-6.0.0-13.3.1 libvirt-bash-completion-6.0.0-13.3.1 libvirt-daemon-config-network-6.0.0-13.3.1 libvirt-daemon-config-nwfilter-6.0.0-13.3.1 libvirt-daemon-driver-libxl-6.0.0-13.3.1 libvirt-daemon-driver-lxc-6.0.0-13.3.1 libvirt-daemon-hooks-6.0.0-13.3.1 libvirt-daemon-lxc-6.0.0-13.3.1 libvirt-daemon-xen-6.0.0-13.3.1 libvirt-devel-6.0.0-13.3.1 libvirt-devel-32bit-6.0.0-13.3.1 libvirt-devel-64bit-6.0.0-13.3.1 libvirt-doc-6.0.0-13.3.1 libvirt-lock-sanlock-6.0.0-13.3.1 libvirt-nss-6.0.0-13.3.1 wireshark-plugin-libvirt-6.0.0-13.3.1 libvirt-client-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-handler:0.38.1 libvirt-libs-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-handler:0.38.1 libvirt-client-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-interface-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-network-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-nodedev-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-nwfilter-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-qemu-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-secret-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-storage-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-storage-core-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-storage-disk-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-storage-iscsi-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-storage-logical-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-storage-mpath-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-storage-rbd-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-driver-storage-scsi-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-daemon-qemu-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-libs-6.0.0-13.3.1 as a component of Container suse/sles/15.2/virt-launcher:0.38.1 libvirt-client-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-Azure libvirt-libs-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-Azure libvirt-client-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-BYOS-Azure libvirt-libs-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-BYOS-Azure libvirt-client-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM libvirt-libs-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM libvirt-client-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-BYOS-GCE libvirt-libs-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-BYOS-GCE libvirt-client-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-EC2-HVM libvirt-libs-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-EC2-HVM libvirt-client-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-GCE libvirt-libs-6.0.0-13.3.1 as a component of Image SLES15-SP2-SAP-GCE libvirt-libs-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP2 libvirt-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-admin-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-bash-completion-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-client-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-config-network-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-config-nwfilter-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-interface-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-libxl-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-lxc-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-network-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-nodedev-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-nwfilter-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-qemu-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-secret-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-storage-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-storage-core-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-storage-disk-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-storage-iscsi-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-storage-logical-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-storage-mpath-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-storage-rbd-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-driver-storage-scsi-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-hooks-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-lxc-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-qemu-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-daemon-xen-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-devel-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-doc-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-lock-sanlock-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 libvirt-nss-6.0.0-13.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2020-14339 Container suse/sles/15.2/virt-handler:0.38.1:libvirt-client-6.0.0-13.3.1 Container suse/sles/15.2/virt-handler:0.38.1:libvirt-libs-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-client-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-interface-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-network-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-nodedev-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-nwfilter-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-qemu-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-secret-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-storage-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-storage-core-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-storage-disk-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-storage-iscsi-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-storage-logical-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-storage-mpath-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-storage-rbd-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-driver-storage-scsi-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-daemon-qemu-6.0.0-13.3.1 Container suse/sles/15.2/virt-launcher:0.38.1:libvirt-libs-6.0.0-13.3.1 Image SLES15-SP2-SAP-Azure:libvirt-client-6.0.0-13.3.1 Image SLES15-SP2-SAP-Azure:libvirt-libs-6.0.0-13.3.1 Image SLES15-SP2-SAP-BYOS-Azure:libvirt-client-6.0.0-13.3.1 Image SLES15-SP2-SAP-BYOS-Azure:libvirt-libs-6.0.0-13.3.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:libvirt-client-6.0.0-13.3.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:libvirt-libs-6.0.0-13.3.1 Image SLES15-SP2-SAP-BYOS-GCE:libvirt-client-6.0.0-13.3.1 Image SLES15-SP2-SAP-BYOS-GCE:libvirt-libs-6.0.0-13.3.1 Image SLES15-SP2-SAP-EC2-HVM:libvirt-client-6.0.0-13.3.1 Image SLES15-SP2-SAP-EC2-HVM:libvirt-libs-6.0.0-13.3.1 Image SLES15-SP2-SAP-GCE:libvirt-client-6.0.0-13.3.1 Image SLES15-SP2-SAP-GCE:libvirt-libs-6.0.0-13.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP2:libvirt-libs-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-admin-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-bash-completion-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-client-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-config-network-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-config-nwfilter-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-interface-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-libxl-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-lxc-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-network-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-nodedev-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-nwfilter-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-qemu-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-secret-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-storage-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-storage-core-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-storage-disk-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-storage-iscsi-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-storage-logical-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-storage-mpath-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-storage-rbd-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-driver-storage-scsi-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-hooks-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-lxc-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-qemu-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-daemon-xen-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-devel-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-doc-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-lock-sanlock-6.0.0-13.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:libvirt-nss-6.0.0-13.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202269-1/ https://www.suse.com/security/cve/CVE-2020-14339.html CVE-2020-14339 https://bugzilla.suse.com/1174458 SUSE Bug 1174458