The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Apr 14, 2016 |
| Suse | — | Upgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-docUpgrade libvirt-daemon-lxcUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-libsUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-bash-completionUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-clientUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-client-32bitUpgrade libvirt-nssUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-interface | Dec 9, 2016 | Apr 14, 2016 |
| Ubuntu | — | Upgrade libvirt-binUpgrade libvirt0 | Feb 2, 2016 | Jan 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub