CVE-2025-12748

Eng Rus

• Credit: Svyatoslav Tereshin (@TERESH1), Artem Mukhin (@saladosss)
• Issues: #687, #825

English

Description

تم اكتشاف مشكلة في إجراء معالجة ملف XML.

يتم تنفيذ معالجة محتوى الملف قبل التحقق من ACL. وهذا يسمح للمستخدم ذي الصلاحيات المحدودة بإرسال ملف XML مُصمم خصيصًا يمكن أن يتسبب في استهلاك مفرط للموارد، مما يؤدي إلى هجوم محتمل لحجب الخدمة (DoS).

Environment Setup

1. OS: Alt Linux P10 server
2. Install and configure libvirt/qemu as per the article (rus lang)

• summary in eng:

apt-get install libvirt libvirt-kvm libvirt-qemu
gpasswd -a user vmusers
systemctl enable --now libvirtd

3. In /etc/libvirt/libvirtd.conf, replace the content with:

listen_tls = 0
listen_tcp = 1
tcp_port = "16509"
listen_addr = "0.0.0.0"
unix_sock_group = "vmusers"
auth_tcp = "none"
access_drivers = ["polkit"]
min_workers = 1
max_workers = 1
prio_workers = 1
admin_min_workers = 1
admin_max_workers = 1

log_outputs="1:file:/var/log/libvirt/libvirtd.log"
log_level = 1

4. Add a rule for polkit (/etc/polkit-1/rules.d/50-libvirt-user.rules):

polkit.addRule(function(action, subject) {
    polkit.log("action=" + action);
    polkit.log("subject=" + subject);
    if ((action.id == "org.libvirt.api.domain.write" || action.id == "org.libvirt.api.domain.save") &&
        subject.user == "user") {
        return polkit.Result.NO;
    }
    else {
        return polkit.Result.YES;
    }
})

5. Restart services: systemctl restart libvirtd polkit

Reproduce

Attempting to access libvirt with a valid XML file:

virsh --connect qemu://system define ./test.xml

The following error will be received:

error: Failed to define domain from ./test.xml
error: access denied: access denied "QEMU"

And the corresponding polkit log:

polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.unix.manage']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.api.connect.getattr' connect_driver='QEMU']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
polkitd[611708]: Unregistered Authentication Agent for unix-process:613904:1401403695 (system bus name :1.113770, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale ru_RU.UTF-8) (disconnected from bus)
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.api.domain.write' domain_name='test-vm' connect_driver='QEMU' domain_uuid='123e4567-e89b-12d3-a456-426614174000']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]

Attempting to access libvirt with a malicious XML file:

virsh --connect qemu://system define ./oom.xml

The log will be empty due to the server hanging, and increased resource consumption by libvirtd can be observed in top.

Руссский

Описание

تم اكتشاف مشكلة أثناء معالجة ملف xml.

يتم تنفيذ معالجة محتوى الملف قبل التحقق من ACL. وهذا يسمح للمستخدم ذي الصلاحيات المحدودة بإرسال ملف XML مصمم خصيصًا يمكن أن يتسبب في استهلاك مفرط للموارد، مما يؤدي إلى هجوم محتمل لحجب الخدمة (DoS).

Настройка окружения

1. ОС Alt Linux P10 server
2. установить/настроить libvirt/qemu по статье
3. в /etc/libvirt/libvirtd.conf заменить текст на:

listen_tls = 0
listen_tcp = 1
tcp_port = "16509"
listen_addr = "0.0.0.0"
unix_sock_group = "vmusers"
auth_tcp = "none"
access_drivers = ["polkit"]
min_workers = 1
max_workers = 1
prio_workers = 1
admin_min_workers = 1
admin_max_workers = 1

log_outputs="1:file:/var/log/libvirt/libvirtd.log"
log_level = 1

4. добавить правило для polkit (/etc/polkit-1/rules.d/50-libvirt-user.rules):

polkit.addRule(function(action, subject) {
    polkit.log("action=" + action);
    polkit.log("subject=" + subject);
    if ((action.id == "org.libvirt.api.domain.write" || action.id == "org.libvirt.api.domain.save") &&
        subject.user == "user") {
        return polkit.Result.NO;
    }
    else {
        return polkit.Result.YES;
    }
})

5. перезапустить: systemctl restart libvirtd polkit

Воспроизведение

Обращение к libvirt с валидным xml-файлом:

virsh --connect qemu://system define ./test.xml

Будет получена ошибка:

ошибка: Не удалось создать описание домена на основе ./test.xml
ошибка: доступ запрещен: доступ запрещен "QEMU"

И соответствующий лог polkit:

polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.unix.manage']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.api.connect.getattr' connect_driver='QEMU']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
polkitd[611708]: Unregistered Authentication Agent for unix-process:613904:1401403695 (system bus name :1.113770, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale ru_RU.UTF-8) (disconnected from bus)
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.api.domain.write' domain_name='test-vm' connect_driver='QEMU' domain_uuid='123e4567-e89b-12d3-a456-426614174000']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]

Обращение к libvirt с вредоносным xml-файлом:

virsh --connect qemu://system define ./oom.xml

Лог будет пустой из-за зависания сервера, в top можно проконтролировать увеличение потребляемых ресурсов libvirtd.