An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Jun 16, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade libvirt | Apr 3, 2024 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-lxcUpgrade libvirt-lock-sanlockUpgrade libvirt-docsUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemonUpgrade libvirt-develUpgrade libvirt-nssUpgrade libvirt-daemon-kvmUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-clientUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-lxcUpgrade libvirtUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-secret | Jun 12, 2020 | Feb 19, 2020 |
| Suse | — | Upgrade libvirt-daemon-hooksUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-qemuUpgrade libvirt-libsUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-config-networkUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-bash-completionUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-adminUpgrade libvirtUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemonUpgrade libvirt-clientUpgrade libvirt-devel | May 15, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libvirt-clientsUpgrade libvirt0Upgrade libvirt-daemon | May 22, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub