Ubuntu has issued an advisory on November 11: http://www.ubuntu.com/usn/usn-2404-1/ Patched packages uploaded for Mageia 3, Mageia 4, and Cauldron. Advisory: ======================== Updated libvirt packages fix security vulnerability: Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file (CVE-2014-7823). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7823 http://www.ubuntu.com/usn/usn-2404-1/ ======================== Updated packages in core/updates_testing: ======================== libvirt0-1.0.2-8.7.mga3 libvirt-devel-1.0.2-8.7.mga3 python-libvirt-1.0.2-8.7.mga3 libvirt-utils-1.0.2-8.7.mga3 libvirt0-1.2.1-1.3.mga4 libvirt-devel-1.2.1-1.3.mga4 libvirt-utils-1.2.1-1.3.mga4 from SRPMS: libvirt-1.0.2-8.7.mga3.src.rpm libvirt-1.2.1-1.3.mga4.src.rpm Reproducible: Steps to Reproduce:
Whiteboard: (none) => MGA3TOO
Procedure: https://bugs.mageia.org/show_bug.cgi?id=14192#c7
CC: (none) => remiWhiteboard: MGA3TOO => MGA3TOO has_procedure
In VirtualBox, M4, KDE, 32-bit Package(s) under test: libvirt-utils python-libvirt default install of package [root@localhost wilcal]# urpmi libvirt-utils Package libvirt-utils-1.2.1-1.2.mga4.i586 is already installed [root@localhost wilcal]# urpmi python-libvirt Package python-libvirt-1.2.1-1.mga4.i586 is already installed MCC -> System -> Manage system services -> Start libvirtd From the procedure: "virt-manage has an icon in the menu in tools => emulators" libvertd seems to be running but there is no emulator icon at Menu -> Tools Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver virtualbox-4.3.10-1.1.mga4.x86_64 virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64
CC: (none) => wilcal.int
libvirt is the service which virt-manager/qemu interacts with. If virt-manager still connects ok when it starts and the VM's still run then libvirt is OK.
Testing complete mga4 64 Note: This can be tested at the same time as the qemu & usbredir update in bug 14434
Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure mga4-64-ok
Testing libvirt on Mageia3-64 real HW with virt-manager-0.9.5-2.mga3 and qemu-1.2.0-8.3.mga3 Current packages : ---------------- # rpm -q lib64virt0 lib64virt-devel python-libvirt lib64virt0-1.0.2-8.6.mga3 lib64virt-devel-1.0.2-8.6.mga3 python-libvirt-1.0.2-8.6.mga3 # systemctl enable libvirtd # systemctl start libvirtd # systemctl status libvirtd showed libvirtd.service running but with one error. Reboot =>> no error left. Installed new guest (crunchbang linux) No problem. Updated to testing packages : --------------------------- - lib64virt-devel-1.0.2-8.7.mga3.x86_64 - lib64virt0-1.0.2-8.7.mga3.x86_64 - libvirt-utils-1.0.2-8.7.mga3.x86_64 - python-libvirt-1.0.2-8.7.mga3.x86_64 Reboot Connected to former guest Created a new guest. All ok
CC: (none) => olchalWhiteboard: MGA3TOO has_procedure mga4-64-ok => MGA3TOO has_procedure mga4-64-ok MGA3-64-OK
Testing complete Mageia 4 i586. Used virt-manager to create a new VM based on a VMDK disk from a Virtualbox VM I had originally created by exporting from VMWare.
Whiteboard: MGA3TOO has_procedure mga4-64-ok MGA3-64-OK => MGA3TOO has_procedure mga4-32-ok mga4-64-ok MGA3-64-OK
Validating, advisory uploaded.
Keywords: (none) => validated_updateWhiteboard: MGA3TOO has_procedure mga4-32-ok mga4-64-ok MGA3-64-OK => MGA3TOO has_procedure mga4-32-ok mga4-64-ok MGA3-64-OK advisoryCC: (none) => sysadmin-bugs
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2014-0470.html
Status: NEW => RESOLVEDResolution: (none) => FIXED