An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Jun 16, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade libvirt | Apr 3, 2024 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storageUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-docsUpgrade libvirt-daemon-lxcUpgrade libvirt-adminUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-libsUpgrade libvirtUpgrade libvirt-login-shellUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-nssUpgrade libvirt-develUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-networkUpgrade libvirt-bash-completionUpgrade libvirt-clientUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-storage-gluster | Jun 12, 2020 | Feb 19, 2020 |
| Suse | — | Upgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-lxcUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-hooksUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-qemuUpgrade libvirt-daemonUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-clientUpgrade libvirt-lock-sanlockUpgrade libvirt-adminUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-develUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-qemu | May 15, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libvirt-daemonUpgrade libvirt0Upgrade libvirt-clients | May 22, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub