CVE-2019-20485 — Improper Input Validation in Redhat Libvirt

CWE-20 — Improper Input ValidationCWE-400 — Uncontrolled Resource Consumption9 documents7 sources
Severity
5.7MEDIUMNVD
EPSS
0.2%
top 58.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat LibvirtDebian LinuxFedoraproject Fedora
Timeline
PublishedMar 19
Latest updateMay 24

Description

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.1 | Impact: 3.6

Affected Packages2 packages

▶NVDredhat/libvirt< 6.0.0
▶Debianredhat/libvirt< 6.0.0-2+3

Also affects: Debian Linux 10.0, 8.0, 9.0, Fedora 31

🔴Vulnerability Details

3
GHSA
GHSA-9283-64xm-984q: qemu/qemu_driver↗2022-05-24
▶
CVEList
CVE-2019-20485: qemu/qemu_driver↗2020-03-19
▶
OSV
CVE-2019-20485: qemu/qemu_driver↗2020-03-19
▶

📋Vendor Advisories

2
Red Hat
libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent↗2019-12-05
▶
Debian
CVE-2019-20485: libvirt - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor j...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-20485 libvirt: potential DoS by holding a monitor job while querying QEMU guest-agent [fedora-all]↗2020-03-03
▶
Bugzilla
CVE-2019-20485 libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent↗2020-03-03
▶
Bugzilla
CVE-2019-20485 virt:8.1/libvirt: potential DoS by holding a monitor job while querying QEMU guest-agent [rhel-av-8]↗2019-10-08
▶
CVE-2019-20485 — Improper Input Validation in Redhat | cvebase