An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Jun 16, 2020 | Apr 28, 2020 |
| Debian | — | Upgrade libvirt | Apr 3, 2024 | Apr 28, 2020 |
| Oracle_linux | — | Upgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-docsUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemonUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-adminUpgrade libvirt-daemon-kvmUpgrade libvirt-develUpgrade libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-driver-secretUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-clientUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-networkUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-bash-completionUpgrade libvirt-daemon-config-network | Jun 12, 2020 | Feb 19, 2020 |
| Suse | — | Upgrade libvirt-docUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-hooksUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemonUpgrade libvirt-nssUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-bash-completionUpgrade libvirt-adminUpgrade libvirt-clientUpgrade libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-develUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-networkUpgrade libvirt-lock-sanlock | May 15, 2020 | Apr 28, 2020 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-clientsUpgrade libvirt-daemon | May 22, 2020 | Apr 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub