libvirt-10.3.0-2.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:13948 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z libvirt-10.3.0-2.1 on GA media These are all security issues fixed in the libvirt-10.3.0-2.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-13948 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:13948 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-4418/ SUSE CVE CVE-2024-4418 page openSUSE Tumbleweed libvirt-10.3.0-2.1 libvirt-client-10.3.0-2.1 libvirt-client-qemu-10.3.0-2.1 libvirt-daemon-10.3.0-2.1 libvirt-daemon-common-10.3.0-2.1 libvirt-daemon-config-network-10.3.0-2.1 libvirt-daemon-config-nwfilter-10.3.0-2.1 libvirt-daemon-driver-interface-10.3.0-2.1 libvirt-daemon-driver-libxl-10.3.0-2.1 libvirt-daemon-driver-lxc-10.3.0-2.1 libvirt-daemon-driver-network-10.3.0-2.1 libvirt-daemon-driver-nodedev-10.3.0-2.1 libvirt-daemon-driver-nwfilter-10.3.0-2.1 libvirt-daemon-driver-qemu-10.3.0-2.1 libvirt-daemon-driver-secret-10.3.0-2.1 libvirt-daemon-driver-storage-10.3.0-2.1 libvirt-daemon-driver-storage-core-10.3.0-2.1 libvirt-daemon-driver-storage-disk-10.3.0-2.1 libvirt-daemon-driver-storage-gluster-10.3.0-2.1 libvirt-daemon-driver-storage-iscsi-10.3.0-2.1 libvirt-daemon-driver-storage-iscsi-direct-10.3.0-2.1 libvirt-daemon-driver-storage-logical-10.3.0-2.1 libvirt-daemon-driver-storage-mpath-10.3.0-2.1 libvirt-daemon-driver-storage-rbd-10.3.0-2.1 libvirt-daemon-driver-storage-scsi-10.3.0-2.1 libvirt-daemon-hooks-10.3.0-2.1 libvirt-daemon-lock-10.3.0-2.1 libvirt-daemon-log-10.3.0-2.1 libvirt-daemon-lxc-10.3.0-2.1 libvirt-daemon-plugin-lockd-10.3.0-2.1 libvirt-daemon-plugin-sanlock-10.3.0-2.1 libvirt-daemon-proxy-10.3.0-2.1 libvirt-daemon-qemu-10.3.0-2.1 libvirt-daemon-xen-10.3.0-2.1 libvirt-devel-10.3.0-2.1 libvirt-doc-10.3.0-2.1 libvirt-libs-10.3.0-2.1 libvirt-nss-10.3.0-2.1 wireshark-plugin-libvirt-10.3.0-2.1 libvirt-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-client-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-client-qemu-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-common-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-config-network-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-config-nwfilter-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-interface-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-libxl-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-lxc-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-network-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-nodedev-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-nwfilter-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-qemu-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-secret-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-core-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-disk-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-gluster-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-iscsi-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-iscsi-direct-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-logical-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-mpath-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-rbd-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-driver-storage-scsi-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-hooks-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-lock-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-log-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-lxc-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-plugin-lockd-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-plugin-sanlock-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-proxy-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-qemu-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-daemon-xen-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-devel-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-doc-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-libs-10.3.0-2.1 as a component of openSUSE Tumbleweed libvirt-nss-10.3.0-2.1 as a component of openSUSE Tumbleweed wireshark-plugin-libvirt-10.3.0-2.1 as a component of openSUSE Tumbleweed A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it. CVE-2024-4418 openSUSE Tumbleweed:libvirt-10.3.0-2.1 openSUSE Tumbleweed:libvirt-client-10.3.0-2.1 openSUSE Tumbleweed:libvirt-client-qemu-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-common-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-config-network-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-config-nwfilter-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-interface-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-libxl-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-lxc-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-network-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-nodedev-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-nwfilter-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-qemu-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-secret-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-core-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-disk-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-gluster-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-iscsi-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-iscsi-direct-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-logical-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-mpath-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-rbd-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-driver-storage-scsi-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-hooks-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-lock-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-log-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-lxc-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-plugin-lockd-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-plugin-sanlock-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-proxy-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-qemu-10.3.0-2.1 openSUSE Tumbleweed:libvirt-daemon-xen-10.3.0-2.1 openSUSE Tumbleweed:libvirt-devel-10.3.0-2.1 openSUSE Tumbleweed:libvirt-doc-10.3.0-2.1 openSUSE Tumbleweed:libvirt-libs-10.3.0-2.1 openSUSE Tumbleweed:libvirt-nss-10.3.0-2.1 openSUSE Tumbleweed:wireshark-plugin-libvirt-10.3.0-2.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-4418.html CVE-2024-4418 https://bugzilla.suse.com/1223849 SUSE Bug 1223849