Re: CVE request -- libvirt: address bus= device= when identicle vendor ID/product IDs usb devices attached are ignored

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/11/2012 10:29 AM, Petr Matousek wrote:
> Description of the problem: libvirt ignores address bus= device=
> when identicle vendor ID/product IDs usb devices attached with
> either virsh or virt-manager.
>
> As a consequence, wrong USB device can be assigned to the wrong
> guest.
>
> References and proposed upstream patch: 
> https://www.redhat.com/archives/libvir-list/2012-April/msg01494.html
>
>  Thanks,

Although there is no direct and simple way to trigger this behavior
(short of having physical access) a security boundary is crossed. An
example scenario: a cloud provider offers to attach a USB drive to the
VM so you can export the data to the HD which is then fedexed to the
customer overnight, or stored separately as a backup, etc. (lets face
it, 3tb delivered overnight is a lot faster than any internet link
I'll ever have).

The problem is that when USB devices are attached it's possible for
the specification of which VM the device is supposed to be attached to
to be ignored, resulting in it being attached to a different VM,
giving it direct access to the hardware.

Please use CVE-2012-2693 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJP1imZAAoJEBYNRVNeJnmT2bEQAI8YlBBK0Rq98bHOxVFrUBdW
FTC1QJjFjQBVN3tG3JasMP6L38mvqeyBPbz+TxfSK8WXzs2VO+hw5ZNoFodLZ1VQ
r01xJmXelX1Cdxu+jFngJhzipGLH0TCjXQFbhTshdA7NxwFhFxdYLe8IJrR+QXWt
coIhpJbHSOa3XblRKDwOT4qcgZCW3/hvSJm9GuMqDNGgkG5ieU9mCkoWFBOYIfuc
iW+sESS+DTtL8utL1S8KulxXdsTVutpDJf9Iu3Tq1JeSv02t/l0hFASCymX0kRZS
e1wrXw9sKhrS1HVRkAW7JJIx2g1nnnatWsdIk7Av9HU1ySDhhpSvJ9nz9btoX6ev
9rhdpwO9RbMqkGiY6KBtIDSGQLwYmBYZcoCFwpKiaZ08pa16pBeoSh4K/9GpVYw+
+Q1nr0yvFWCSzD2oLjZzvRzQnjhDfw9zXbmRhx5EqmOEy//VjPGLnNT9BybJ0Va7
tVTaraRls1arA7hju6UPMd8vo9VqZq52h9fCr9+ja8MQOrkLoAG2LBdLgqMYwYv6
bptMJBGhyJEithT/qZAZnIxk901L3xAVH2oY8PuEsi/L8jFHt92wEZ3scIbJESrG
SVcHkt5HcRv9iuoUwCLBdlCAT9BzTRQGBG96a/s/hKkyVhj8kprYTwYPrfJbdjf+
rcyx+D/2dfEbj5YcOj3q
=UdD1
-----END PGP SIGNATURE-----