An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Jun 16, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade libvirt | Apr 3, 2024 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-nssUpgrade libvirtUpgrade libvirt-develUpgrade libvirt-daemon-kvmUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-secretUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-clientUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storageUpgrade libvirt-lock-sanlockUpgrade libvirt-adminUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-lxc | Jun 12, 2020 | Feb 19, 2020 |
| Suse | — | Upgrade libvirt-daemon-driver-secretUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-clientUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-bash-completionUpgrade libvirtUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-xenUpgrade libvirt-nssUpgrade libvirt-daemonUpgrade libvirt-adminUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-libsUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-rbd | May 15, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-clientsUpgrade libvirt-daemon | May 22, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub