Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 85

Export CSV
CVE-2022-0897

libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service

A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).

CVSS 3.1 · 4.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Netapp Redhat
Products
Ontap Select Deploy Administration Utility Enterprise Linux Libvirt
CVE-2021-3975

libvirt: segmentation fault during VM shutdown can lead to vdsm hang

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2021-3631

libvirt: Insecure sVirt label generation

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Redhat
Products
Ontap Select Deploy Administration Utility Advanced Virtualization Enterprise Linux and 2 more
CVE-2021-3559

libvirt: nodedev-list command may cause libvirt to crash on hosts with GRID driver installed

A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. It only affects hosts with a PCI device and driver that supports mediated devices (e.g., GRID driver). This flaw could be used by an unprivileged client with a read-only connection to crash the libvirt daemon by executing the 'nodedev-list' virsh command. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Netapp Redhat
Products
Ontap Select Deploy Administration Utility Libvirt
CVE-2020-25637

libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Redhat
Products
Leap Advanced Virtualization Enterprise Linux and 1 more
CVE-2020-14339

libvirt: leak of /dev/mapper/control into QEMU guests

A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Libvirt
CVE-2020-14301

libvirt: leak of sensitive cookie information via dumpxml

An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Ontap Select Deploy Administration Utility Advanced Virtualization Codeready Linux Builder and 11 more
CVE-2020-12430

libvirt: memory leak in domstats may allow read-only user to perform DoS attack

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt
CVE-2020-10703

libvirt: Potential denial of service via active pool without target path

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt
CVE-2020-10701

libvirt: guest agent timeout can be set under read-only mode leading to DoS

A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2019-3886

libvirt: virsh domhostname command discloses guest hostname in readonly mode

An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Leap Advanced Virtualization and 1 more
CVE-2019-3840

libvirt: NULL pointer dereference after running qemuAgentCommand in qemuAgentGetInterfaces function

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.

CVSS 3.0 · 5.8 Medium EPSS 1.5% KEV · Not listed
Vendors
Opensuse Redhat
Products
Leap Enterprise Linux Libvirt
CVE-2019-20485

libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Advanced Virtualization and 2 more
CVE-2019-10168

libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more
CVE-2019-10167

libvirt: arbitrary command execution via virConnectGetDomainCapabilities API

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more
CVE-2019-10166

libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more
CVE-2019-10161

libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Redhat
Products
Ubuntu Linux Advanced Virtualization Enterprise Linux and 3 more
CVE-2019-10132

libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Advanced Virtualization Enterprise Linux and 1 more
CVE-2018-6764

libvirt: guest could inject executable code via libnss_dns.so loaded by libvirt_lxc before init

util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat
Products
Ubuntu Linux Debian Linux Enterprise Linux and 5 more