The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Apr 14, 2016 |
| Suse | — | Upgrade libvirt-daemon-hooksUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-qemuUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-libsUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-clientUpgrade libvirtUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-networkUpgrade libvirt-nss | Dec 9, 2016 | Apr 14, 2016 |
| Ubuntu | — | Upgrade libvirt-binUpgrade libvirt0 | Feb 2, 2016 | Jan 12, 2016 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub