Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Aug 30, 2017 | Jan 24, 2014 |
| Centos_linux | — | Upgrade libvirt-clientUpgrade libvirt-lock-sanlockUpgrade libvirt-pythonUpgrade libvirtUpgrade libvirt-devel | Dec 1, 2016 | Jan 24, 2014 |
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Jan 24, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Jan 24, 2014 |
| Oracle_linux | — | Upgrade libvirt-develUpgrade libvirt-clientUpgrade libvirtUpgrade libvirt-lock-sanlockUpgrade libvirt-python | Oct 16, 2024 | Jan 24, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 13, 2013 |
| Suse | — | Upgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-qemuUpgrade libvirt-pythonUpgrade libvirt-daemon-vboxUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-umlUpgrade libvirt-daemon-driver-vboxUpgrade sle-sdk-releaseUpgrade libvirt-docUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-secretUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-xenUpgrade libvirt-daemon-config-networkUpgrade libvirt-lock-sanlockUpgrade libvirtUpgrade libvirt-devel-32bitUpgrade libvirt-develUpgrade libvirt-daemonUpgrade libvirt-clientUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-umlUpgrade libvirt-daemon-driver-nwfilter | Feb 25, 2014 | Jan 24, 2014 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-bin | Nov 8, 2024 | Jan 24, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub