CVE-2011-1146 Missing authorization in n/a

Medium 6.9 Published 15 Mar 2011 Updated 6 Aug 2024

Remote attackers with read-only access can cause host crashes or execute code via improper restriction of specific libvirt API calls.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-1146?

CVE-2011-1146 is a medium-severity missing authorization vulnerability in Redhat Libvirt, published on 15 Mar 2011. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Weakness: CWE-264

Which versions are affected by CVE-2011-1146?

It affects 1 product.

Linux distribution packages (24)

`libvirt` Red Hat:enterprise_linux:6::client	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-client` Red Hat:enterprise_linux:6::client	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-devel` Red Hat:enterprise_linux:6::client	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-python` Red Hat:enterprise_linux:6::client	All versions	`0:0.8.1-27.el6_0.5`
`libvirt` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-client` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-python` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.8.1-27.el6_0.5`
`libvirt` Red Hat:enterprise_linux:6::server	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-client` Red Hat:enterprise_linux:6::server	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-devel` Red Hat:enterprise_linux:6::server	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-python` Red Hat:enterprise_linux:6::server	All versions	`0:0.8.1-27.el6_0.5`
`libvirt` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-client` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.8.1-27.el6_0.5`
`libvirt-python` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.8.1-27.el6_0.5`
`libvirt` Red Hat:rhel_virtualization:5::server	All versions	`0:0.8.2-15.el5_6.3`
`libvirt-debuginfo` Red Hat:rhel_virtualization:5::server	All versions	`0:0.8.2-15.el5_6.3`
`libvirt-devel` Red Hat:rhel_virtualization:5::server	All versions	`0:0.8.2-15.el5_6.3`
`libvirt-python` Red Hat:rhel_virtualization:5::server	All versions	`0:0.8.2-15.el5_6.3`

Products include Redhat Libvirt.

How do I fix CVE-2011-1146?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2011-1146 being exploited?

There is no known exploitation of CVE-2011-1146 in the wild and no public exploit code.

All Redhat Libvirt vulnerabilities

Sources

Also known as DEBIAN-CVE-2011-1146, DSA-2194-1, GHSA-69mw-4jhr-4j3r, RHSA-2011:0391.