摘要:
libvirt security update
安全等级: Medium
公告ID: KylinSec-SA-2024-3523
发布日期: 2024年5月31日
关联CVE: CVE-2024-4418
Libvirt是一个C工具包，用于与最新版本的Linux（和其他操作系统）的虚拟化功能进行交互。主包包括导出虚拟化支持的libvirtd服务器。
安全修复：
在libvirt中发现了一个导致堆栈在释放后使用的竞争条件。由于virNetClientIOEventLoop（）方法中的一个错误假设，指向堆栈分配的virNetClientIOTEventData结构的`data`指针最终被用于virNetClientIOLEventFD回调，而数据指针的堆栈帧在从virNetClientIO EventHoop（）返回时同时被“释放”。“virtproxyd”守护进程可用于触发请求。如果libvirt配置了细粒度的访问控制，理论上，这个问题允许用户逃避他们原本有限的访问。此漏洞允许本地无权限用户在不进行身份验证的情况下访问virtproxyd。远程用户在访问之前需要进行身份验证。（CVE-2024-4418）
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2024-4418 | KY3.4-5A | libvirt | Fixed |
| CVE-2024-4418 | KY3.5.2 | libvirt | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| libvirt-daemon | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-config-nwfilter | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-kvm | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-docs | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-scsi | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-secret | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-gluster | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-client | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-bash-completion | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-nwfilter | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-interface | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-config-network | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-nss | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-rbd | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-nodedev | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-qemu | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-wireshark | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-admin | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-lock-sanlock | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-core | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-disk | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-network | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-libs | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-logical | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-iscsi-direct | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-qemu | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-iscsi | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-devel | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-mpath | x86_64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-nss | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-nwfilter | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-wireshark | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-core | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-qemu | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-config-nwfilter | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-kvm | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-scsi | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-lock-sanlock | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-iscsi-direct | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-libs | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-nodedev | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-interface | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-network | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-qemu | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-admin | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-client | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-devel | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-bash-completion | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-secret | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-gluster | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-mpath | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-disk | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-rbd | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-config-network | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-iscsi | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-docs | aarch64 | 6.2.0-25.kb1.ky3_4 |
| libvirt-daemon-driver-storage-logical | aarch64 | 6.2.0-25.kb1.ky3_4 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| libvirt-client | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-network | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-devel | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-logical | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-docs | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-libs | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-mpath | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-iscsi | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-nodedev | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-scsi | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-lock-sanlock | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-nss | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-admin | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-config-network | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-kvm | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-bash-completion | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-rbd | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-qemu | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-qemu | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-config-nwfilter | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-disk | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-wireshark | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-core | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-nwfilter | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-gluster | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-interface | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-iscsi-direct | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-secret | x86_64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-config-nwfilter | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-nss | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-disk | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-network | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-bash-completion | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-devel | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-iscsi | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-client | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-docs | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-kvm | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-config-network | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-qemu | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-mpath | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-interface | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-core | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-gluster | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-secret | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-qemu | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-admin | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-libs | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-lock-sanlock | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-wireshark | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-logical | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-iscsi-direct | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-scsi | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-nwfilter | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-nodedev | aarch64 | 6.2.0-64.ky3_5.kb1 |
| libvirt-daemon-driver-storage-rbd | aarch64 | 6.2.0-64.ky3_5.kb1 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-interface
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-storage-core
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-interface
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-rbd
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-interface
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-interface
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-scsi
