The qemu implementation of virConnectGetAllDomainStats in libvirt before 1.2.11 does not properly handle locks when a domain is skipped due to ACL restrictions, which allows a remote authenticated users to cause a denial of service (deadlock or segmentation fault and crash) via a request to access the users does not have privileges to access.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Jan 6, 2015 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Jan 6, 2015 |
| Suse | — | Upgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-docUpgrade libvirtUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-nssUpgrade libvirt-clientUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-lxcUpgrade libvirt-libsUpgrade libvirt-develUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-secretUpgrade libvirt-adminUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage | Dec 18, 2015 | Jan 2, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub