The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Apr 14, 2016 |
| Suse | — | Upgrade libvirt-nssUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-qemuUpgrade libvirtUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-xenUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-config-networkUpgrade libvirt-clientUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-docUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-develUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-qemu | Dec 9, 2016 | Apr 14, 2016 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-bin | Feb 2, 2016 | Jan 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub