The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Apr 14, 2016 |
| Suse | — | Upgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-adminUpgrade libvirt-lock-sanlockUpgrade libvirt-develUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-libsUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-docUpgrade libvirt-daemon-hooksUpgrade libvirt-clientUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-config-networkUpgrade libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-networkUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemonUpgrade libvirt-nssUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-bash-completionUpgrade libvirt-daemon-xen | Dec 9, 2016 | Apr 14, 2016 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-bin | Feb 2, 2016 | Jan 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub