libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libvirt-develUpgrade libvirtUpgrade libvirt-python | Dec 1, 2016 | Mar 15, 2011 |
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Mar 15, 2011 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Mar 15, 2011 |
| Oracle_linux | — | Upgrade libvirt-clientUpgrade libvirt-develUpgrade libvirt-pythonUpgrade libvirt | Oct 16, 2024 | Mar 15, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 2, 2011 |
| Suse | — | Upgrade libvirt-client-qemuUpgrade libvirt-libsUpgrade libvirt-daemon-qemuUpgrade libvirt-pythonUpgrade libvirt-docUpgrade libvirtUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-develUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-networkUpgrade libvirt-ssh-proxyUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-logUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-nssUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-proxyUpgrade libvirt-clientUpgrade libvirt-devel-32bitUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-lockUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-lxcUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-plugin-lockd | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libvirt0 | Nov 8, 2024 | Mar 15, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub