Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 85

Export CSV
CVE-2013-0170

libvirt: use-after-free in virNetMessageFree()

Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.

CVSS 2.0 · 6.8 Medium EPSS 5.8% KEV · Not listed
Vendors
Canonical Fedoraproject Opensuse and 2 more
Products
Ubuntu Linux Fedora Opensuse and 9 more
CVE-2013-1766

libvirt: kvm-group writable storage

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-1962

libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool

The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt
CVE-2013-2218

libvirt: virConnectListAllInterfaces crash

Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1.0.6 allows remote attackers to cause a denial of service (libvirtd crash) via a filtering flag that causes an interface to be skipped, as demonstrated by the "virsh iface-list --inactive" command.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-2230

libvirt: multiple registered events crash

The qemu driver (qemu/qemu_driver.c) in libvirt before 1.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via unspecified vectors involving "multiple events registration."

CVSS 2.0 · 4.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4153

libvirt: double free of returned JSON array in qemuAgentGetVCPUs()

Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c in libvirt 1.0.6 through 1.1.0 allows remote attackers to cause a denial of service (daemon crash) via a cpu count request, as demonstrated by the "virsh vcpucount dom --guest" command.

CVSS 2.0 · 5.0 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4154

libvirt: crash of libvirtd without guest agent configuration

The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to "agent based cpu (un)plug," as demonstrated by the "virsh vcpucount foobar --guest" command.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4239

libvirt: memory corruption in xenDaemonListDefinedDomains function

The xenDaemonListDefinedDomains function in xen/xend_internal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of service (memory corruption and crash) via vectors involving the virConnectListDefinedDomains API function.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4292

libvirt: unbounded RPC arrays in remote protocol

libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory consumption) via a large number of domain migrate parameters in certain RPC calls in (1) daemon/remote.c and (2) remote/remote_driver.c.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4296

libvirt: invalid free in remoteDispatchDomainMemoryStats

The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt 0.9.1 through 0.10.1.x, 0.10.2.x before 0.10.2.8, 1.0.x before 1.0.5.6, and 1.1.x before 1.1.2 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a crafted RPC call.

CVSS 2.0 · 4.0 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Redhat
Products
Ubuntu Linux Enterprise Linux Libvirt
CVE-2013-4297

libvirt: invalid free in virFileNBDDeviceAssociate

The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and earlier allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via unspecified vectors.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4311

libvirt: insecure calling of polkit

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Redhat
Products
Ubuntu Linux Enterprise Linux Libvirt
CVE-2013-4400

libvirt: virt-login-shell arbitrary file overwrites vulnerability

virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files and possibly gain privileges via unspecified environment variables or command-line arguments.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-4401

libvirt: unintended API access due to incorrect permissions checks

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 8.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-5651

libvirt: virBitmapParse out-of-bounds read access

The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap, as demonstrated by a large nodeset value to numatune.

CVSS 2.0 · 5.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-6436

libvirt: crash in lxcDomainGetMemoryParameters

The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the status of LXC guests when reading memory tunables, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) via a guest in the shutdown status, as demonstrated by the "virsh memtune" command.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-6457

libvirt: avoid crashing if calling 'virsh numatune' on an inactive domain (libxl)

The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not properly initialize the nodemap, which allows local users to cause a denial of service (invalid free operation and crash) or possibly execute arbitrary code via an inactive domain to the virsh numatune command.

CVSS 2.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2013-6458

qemu: job usage issue in several APIs leading to libvirtd crash

Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt
CVE-2021-3667

libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Netapp Redhat
Products
Debian Linux Ontap Select Deploy Administration Utility Advanced Virtualization and 2 more
CVE-2023-2700

libvirt: Memory leak in virPCIVirtualFunctionList cleanup

A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Libvirt and 1 more