Threats Tagged 'cve-2026-61477'

This update for libvirt fixes the following issues: - CVE-2026-18917: integer overflow in `NodeGetFreePages` RPC handler leads to heap buffer overflow and allows for possible local privilege escalation (bsc#1275863). - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for `dnsmasq` configuration directive injection and can lead to arbitrary code execution as root (bsc#1274576). - CVE-2026-63622: symlink-following in `virFileChownFiles()` allows `swtpm` user to trick the root-level `libvirt` daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264). - CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can lead to sensitive information disclosure (bsc#1275265). - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks and allows for root-owned file ownership changes, which can lead to privilege escalation (bsc#1274946).

An injection vulnerability exists in libvirt's virtual network driver due to improper handling of newline characters in DNS TXT and SRV record attributes. This flaw allows users with permission to define virtual networks to inject arbitrary dnsmasq configuration directives, potentially leading to arbitrary command execution as root. The vulnerability has a medium severity rating with a CVSS score of 2.3. A patch is available to address this issue.

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.