The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libvirt-clientUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-kvmUpgrade libvirt-pythonUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-lxcUpgrade libvirtUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-docsUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-storageUpgrade libvirt-develUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-lxcUpgrade libvirt-daemonUpgrade libvirt-lock-sanlock | Dec 1, 2016 | Oct 6, 2014 |
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Oct 6, 2014 |
| Oracle_linux | — | Upgrade libvirt-pythonUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-login-shellUpgrade libvirtUpgrade libvirt-daemon-driver-storageUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-networkUpgrade libvirt-docsUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-clientUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-develUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-secret | Oct 16, 2024 | Oct 6, 2014 |
| Suse | — | Upgrade libvirt-lock-sanlockUpgrade libvirt-adminUpgrade kvmUpgrade libvirt-docUpgrade libvirt-clientUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirtUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-networkUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-qemuUpgrade libvirt-libsUpgrade libvirt-daemonUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-nssUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-pythonUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-devel-32bitUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-scsi | Dec 18, 2015 | Oct 6, 2014 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-bin | Nov 8, 2024 | Oct 6, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub