The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | May 27, 2021 |
| Suse | — | Upgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-docUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-libsUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-networkUpgrade libvirt-clientUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-xenUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-adminUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-develUpgrade libvirt-bash-completionUpgrade libvirt-nssUpgrade libvirtUpgrade libvirt-daemon-driver-nwfilter | Feb 4, 2022 | May 27, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub