An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Jun 16, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade libvirt | Apr 3, 2024 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-secretUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-nssUpgrade libvirt-clientUpgrade libvirt-login-shellUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-develUpgrade libvirtUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storageUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-qemuUpgrade libvirt-libsUpgrade libvirt-adminUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-core | Jun 12, 2020 | Feb 19, 2020 |
| Suse | — | Upgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-lock-sanlockUpgrade libvirt-develUpgrade libvirt-daemon-driver-secretUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-bash-completionUpgrade libvirtUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-nssUpgrade libvirt-clientUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-hooksUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-logical | May 15, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libvirt-daemonUpgrade libvirt-clientsUpgrade libvirt0 | May 22, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub