Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1.0.6 allows remote attackers to cause a denial of service (libvirtd crash) via a filtering flag that causes an interface to be skipped, as demonstrated by the "virsh iface-list --inactive" command.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Sep 30, 2013 |
| Suse | — | Upgrade libvirt-daemon-driver-networkUpgrade libvirtUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-libsUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-xenUpgrade libvirt-nssUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-docUpgrade libvirt-daemonUpgrade libvirt-daemon-hooksUpgrade libvirt-client-32bitUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-clientUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storageUpgrade libvirt-develUpgrade libvirt-daemon-driver-secretUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-nwfilter | Aug 9, 2024 | Sep 30, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub