CVE-2011-1146 — Redhat Libvirt vulnerability

9 documents8 sources
Severity
6.9MEDIUMNVD
CNA7.2OSV7.2
EPSS
1.6%
top 18.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Libvirt
Timeline
PublishedMar 15
Latest updateMay 17

Description

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

CVSS vector

AV:L/AC:M/C:C/I:C/A:CExploitability: 3.4 | Impact: 10.0

Affected Packages2 packages

▶Debianredhat/libvirt< 0.8.8-3+3
▶NVDredhat/libvirt0.8.8

Patches

Patch: bugs.debian.org ↗Patch: openwall.com ↗Patch: openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-69mw-4jhr-4j3r: libvirt↗2022-05-17
▶
CVEList
CVE-2011-1146: libvirt↗2011-03-15
▶
OSV
CVE-2011-1146: libvirt↗2011-03-15
▶

📋Vendor Advisories

3
Ubuntu
Libvirt vulnerability↗2011-03-29
▶
Red Hat
libvirt: several API calls do not honour read-only connection↗2011-03-02
▶
Debian
CVE-2011-1146: libvirt - libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operati...↗2011
▶

💬Community

2
Bugzilla
CVE-2011-1146 libvirt: several API calls do not honour read-only connection↗2011-03-09
▶
Bugzilla
CVE-2011-1146 libvirt: several API calls do not honour read-only connection [fedora-all]↗2011-03-09
▶
CVE-2011-1146 — Redhat Libvirt vulnerability | cvebase