Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-63623: A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines. CVE-2026-63622: A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control. CVE-2026-61478: libvirt: Check for empty string condition and skip inclusion of the XML document context in the error message. CVE-2026-61477: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libvirt | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-admin | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-bash-completion | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-client | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-config-network | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-config-nwfilter | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-interface | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-lxc | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-network | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-nodedev | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-nwfilter | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-qemu | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-secret | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage-core | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage-disk | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage-gluster | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage-iscsi | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage-logical | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage-mpath | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage-rbd | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-driver-storage-scsi | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-kvm | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-daemon-lxc | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-debuginfo | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-devel | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-docs | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-libs | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-lock-sanlock | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-login-shell | 0:4.5.0-36.amzn2.3.3 |
| Amazon Linux · 2 | libvirt-nss | 0:4.5.0-36.amzn2.3.3 |
Vulnerabilities 3
-
High 7.8
Libvirt: swtpm privilege escalation via symlink following
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, …
-
Medium 5.5
Libvirt: information disclosure via world-readable storage volume images during clone/convert
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local us…
-
Low 2.3
Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq…