Date: Mon, 11 Jun 2012 11:23:37 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE request -- libvirt: address bus= device= when identicle vendor ID/product IDs usb devices attached are ignored -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/11/2012 10:29 AM, Petr Matousek wrote: > Description of the problem: libvirt ignores address bus= device= > when identicle vendor ID/product IDs usb devices attached with > either virsh or virt-manager. > > As a consequence, wrong USB device can be assigned to the wrong > guest. > > References and proposed upstream patch: > https://www.redhat.com/archives/libvir-list/2012-April/msg01494.html > > Thanks, Although there is no direct and simple way to trigger this behavior (short of having physical access) a security boundary is crossed. An example scenario: a cloud provider offers to attach a USB drive to the VM so you can export the data to the HD which is then fedexed to the customer overnight, or stored separately as a backup, etc. (lets face it, 3tb delivered overnight is a lot faster than any internet link I'll ever have). The problem is that when USB devices are attached it's possible for the specification of which VM the device is supposed to be attached to to be ignored, resulting in it being attached to a different VM, giving it direct access to the hardware. Please use CVE-2012-2693 for this issue. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJP1imZAAoJEBYNRVNeJnmT2bEQAI8YlBBK0Rq98bHOxVFrUBdW FTC1QJjFjQBVN3tG3JasMP6L38mvqeyBPbz+TxfSK8WXzs2VO+hw5ZNoFodLZ1VQ r01xJmXelX1Cdxu+jFngJhzipGLH0TCjXQFbhTshdA7NxwFhFxdYLe8IJrR+QXWt coIhpJbHSOa3XblRKDwOT4qcgZCW3/hvSJm9GuMqDNGgkG5ieU9mCkoWFBOYIfuc iW+sESS+DTtL8utL1S8KulxXdsTVutpDJf9Iu3Tq1JeSv02t/l0hFASCymX0kRZS e1wrXw9sKhrS1HVRkAW7JJIx2g1nnnatWsdIk7Av9HU1ySDhhpSvJ9nz9btoX6ev 9rhdpwO9RbMqkGiY6KBtIDSGQLwYmBYZcoCFwpKiaZ08pa16pBeoSh4K/9GpVYw+ +Q1nr0yvFWCSzD2oLjZzvRzQnjhDfw9zXbmRhx5EqmOEy//VjPGLnNT9BybJ0Va7 tVTaraRls1arA7hju6UPMd8vo9VqZq52h9fCr9+ja8MQOrkLoAG2LBdLgqMYwYv6 bptMJBGhyJEithT/qZAZnIxk901L3xAVH2oY8PuEsi/L8jFHt92wEZ3scIbJESrG SVcHkt5HcRv9iuoUwCLBdlCAT9BzTRQGBG96a/s/hKkyVhj8kprYTwYPrfJbdjf+ rcyx+D/2dfEbj5YcOj3q =UdD1 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.