The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Aug 30, 2017 | Apr 15, 2014 |
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Apr 15, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Apr 15, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 17, 2013 |
| Suse | — | Upgrade libvirt-daemon-driver-umlUpgrade libvirt-daemon-driver-interfaceUpgrade libvirtUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-vboxUpgrade libvirt-daemon-driver-vboxUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-umlUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-login-shellUpgrade libvirt-client-32bitUpgrade libvirt-daemonUpgrade libvirt-pythonUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-clientUpgrade sle-sdk-releaseUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-docUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-xenUpgrade libvirt-develUpgrade libvirt-daemon-driver-storageUpgrade libvirt-devel-32bitUpgrade libvirt-lock-sanlock | May 29, 2014 | Apr 15, 2014 |
| Ubuntu | — | Upgrade libvirt-binUpgrade libvirt0 | Nov 8, 2024 | Apr 15, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub