1. 漏洞描述

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.(CVE-2024-4418)

2. 影响范围

3. 影响组件

4. 修复版本

5. 修复方法

方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm

方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名

6. 下载链接

V6:

x86_64:

     libvirt-daemon-plugin-lockd   

     libvirt-daemon-driver-secret   

     libvirt-daemon-config-network   

     libvirt-libs   

     libvirt-daemon-log   

     libvirt-daemon-driver-storage-iscsi-direct   

     libvirt-daemon-driver-nwfilter   

     libvirt-daemon-driver-network   

     libvirt-client   

     libvirt-daemon-driver-storage-logical   

     libvirt-daemon-driver-storage-iscsi   

     libvirt-daemon-driver-storage-mpath   

     libvirt-daemon-driver-nodedev   

     libvirt-daemon-proxy   

     libvirt-daemon-lock   

     libvirt-daemon-common   

     libvirt-daemon-qemu   

     libvirt   

     libvirt-daemon-config-nwfilter   

     libvirt-daemon-driver-storage-scsi   

     libvirt-daemon-driver-qemu   

     libvirt-daemon-driver-interface   

     libvirt-daemon-driver-storage-rbd   

     libvirt-daemon-driver-storage-gluster   

     libvirt-daemon-kvm   

     libvirt-daemon   

     libvirt-daemon-driver-storage-core   

     libvirt-devel   

     libvirt-wireshark   

     libvirt-daemon-driver-storage   

     libvirt-daemon-plugin-sanlock   

     libvirt-daemon-driver-storage-disk   

     libvirt-docs   

     libvirt-nss   

aarch64:

     libvirt   

     libvirt-daemon   

     libvirt-daemon-config-nwfilter   

     libvirt-daemon-qemu   

     libvirt-daemon-driver-interface   

     libvirt-daemon-driver-storage-iscsi-direct   

     libvirt-devel   

     libvirt-nss   

     libvirt-daemon-plugin-sanlock   

     libvirt-wireshark   

     libvirt-daemon-driver-nodedev   

     libvirt-daemon-lock   

     libvirt-daemon-driver-storage-disk   

     libvirt-daemon-driver-storage-gluster   

     libvirt-libs   

     libvirt-daemon-driver-storage-core   

     libvirt-daemon-driver-network   

     libvirt-daemon-driver-nwfilter   

     libvirt-daemon-config-network   

     libvirt-daemon-driver-storage   

     libvirt-daemon-log   

     libvirt-client   

     libvirt-daemon-driver-secret   

     libvirt-daemon-proxy   

     libvirt-docs   

     libvirt-daemon-plugin-lockd   

     libvirt-daemon-kvm   

     libvirt-daemon-common   

     libvirt-daemon-driver-storage-iscsi   

     libvirt-daemon-driver-storage-mpath   

     libvirt-daemon-driver-storage-rbd   

     libvirt-daemon-driver-qemu   

     libvirt-daemon-driver-storage-scsi   

     libvirt-daemon-driver-storage-logical