Description

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.3",
  "pubDate": "2026-08-07T14:17:00.187Z",
  "pubdate": "2026-08-07T14:17:00.187Z",
  "executiveSummary": "An injection vulnerability has been identified in the virtual network driver of libvirt. The security flaw stems from the network XML parser failing to properly sanitize and strip newline characters from DNS TXT record value attributes as well as SRV record domain and target attributes. These unsanitized values are subsequently written verbatim into the dnsmasq configuration files dynamically generated by the libvirt network driver.\nThe primary impact of this vulnerability is arbitrary command execution operating with root privileges. An attacker who possesses the necessary authorization to define virtual networks can craft malicious XML configurations containing injected dnsmasq directives, such as dhcp-script. When dnsmasq processes the malformed configuration file, it executes the specified arbitrary commands under the administrative security context of the root user.\nThis vulnerability directly affects libvirt installations utilizing the virtual network driver and dnsmasq backend. The risk implication is severe, as it facilitates a complete host privilege escalation vector for users restricted solely to virtual network management. Exploitation requires authenticated access to define or modify virtual network XML configurations within the libvirt environment.",
  "technicalDetails": "The root cause of the vulnerability resides within the network XML parser of the libvirt virtual network driver. Specifically, the parsing logic fails to validate or sanitize input strings by stripping newline characters (\\n) from specific DNS configuration attributes. The vulnerable components include the value attributes of DNS TXT records and the domain and target attributes of SRV records.\nDuring the initialization of a virtual network, libvirt translates the defined XML configuration into a corresponding configuration file utilized by the dnsmasq service. Because the XML parser does not filter newline characters, an authenticated user with permissions to define virtual networks can inject arbitrary configuration directives by embedding newline characters followed by malicious dnsmasq commands within the targeted TXT or SRV record attributes.\nThe step-by-step attack flow proceeds as follows: First, the attacker authenticates to the libvirt daemon with permissions sufficient to define or modify a virtual network. Second, the attacker crafts a malicious virtual network XML document containing newline characters within a DNS TXT record value or SRV record domain/target attribute. Third, the attacker injects configuration directives supported by dnsmasq, such as dhcp-script pointing to an arbitrary executable payload. Fourth, the attacker submits the XML definition to libvirt, which parses the structure without stripping the embedded newline characters. Fifth, libvirt generates the dnsmasq configuration file, causing the injected directives to be interpreted as separate, valid configuration lines by dnsmasq. Finally, upon triggering the relevant dnsmasq event or service restart, the external script or command is executed with root privileges, achieving arbitrary command execution.\nThe privilege requirements mandate that the actor possesses permissions to define virtual networks via the libvirt API. Authentication is required, but the impact results in full administrative compromise of the underlying host operating system due to the execution context of the dnsmasq daemon and its spawned child processes."
}