libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libvirt-develUpgrade libvirtUpgrade libvirt-python | Dec 1, 2016 | Mar 15, 2011 |
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Mar 15, 2011 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Mar 15, 2011 |
| Oracle_linux | — | Upgrade libvirt-pythonUpgrade libvirtUpgrade libvirt-develUpgrade libvirt-client | Oct 16, 2024 | Mar 15, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 2, 2011 |
| Suse | — | Upgrade libvirt-daemon-config-networkUpgrade libvirt-docUpgrade libvirt-adminUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-pythonUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-libsUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-ssh-proxyUpgrade libvirt-client-qemuUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirtUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-logUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-nssUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-lockUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-proxyUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-plugin-lockdUpgrade libvirt-clientUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-devel-32bitUpgrade libvirt-lock-sanlockUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-config-nwfilter | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libvirt0 | Nov 8, 2024 | Mar 15, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub