The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not properly initialize the nodemap, which allows local users to cause a denial of service (invalid free operation and crash) or possibly execute arbitrary code via an inactive domain to the virsh numatune command.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Jan 24, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Jan 24, 2014 |
| Suse | — | Upgrade libvirt-develUpgrade libvirt-daemon-vboxUpgrade libvirt-daemon-driver-umlUpgrade libvirt-daemonUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-vboxUpgrade libvirt-devel-32bitUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-config-networkUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-umlUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-secretUpgrade libvirt-docUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-xenUpgrade libvirt-client-32bitUpgrade libvirt-pythonUpgrade libvirt-daemon-driver-xenUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-clientUpgrade libvirtUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-nwfilter | Feb 25, 2014 | Jan 24, 2014 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-bin | Nov 8, 2024 | Jan 24, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub