Debian Libvirt vulnerabilities

CVE-2021-4147 [MEDIUM] CVE-2021-4147: libvirt - A flaw was found in the libvirt libxl driver. A malicious guest could continuous... A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service condition. Scope: local bookworm: resolved (fixed in 7.10.0-2) bullseye: resolved (fixed in 7.0.0-3+deb11u3) forky: resolved (fixed in 7.10.0-2) sid: resolved (fixed in 7.10.0-2) trixie

CVE-2012-4423 [MEDIUM] CVE-2012-4423: libvirt - The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows rem... The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the RPC dispatch table. Scope: local bookworm: resolved (fixed in 0.9.12-5) bullseye: resolve

CVE-2024-2494 [MEDIUM] CVE-2024-2494: libvirt - A flaw was found in the RPC library APIs of libvirt. The RPC server deserializat... A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged

CVE-2024-8235 [MEDIUM] CVE-2024-8235: libvirt - A flaw was found in libvirt. A refactor of the code fetching the list of interfa... A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to

CVE-2013-4153 [MEDIUM] CVE-2013-4153: libvirt - Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c... Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c in libvirt 1.0.6 through 1.1.0 allows remote attackers to cause a denial of service (daemon crash) via a cpu count request, as demonstrated by the "virsh vcpucount dom --guest" command. Scope: local bookworm: resolved (fixed in 1.1.0-4) bullseye: resolved (fixed in 1.1.0-4) forky: resol

CVE-2015-5160 [MEDIUM] CVE-2015-5160: libvirt - libvirt before 2.2 includes Ceph credentials on the qemu command line when using... libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing. Scope: local bookworm: resolved (fixed in 2.2.0-1) bullseye: resolved (fixed in 2.2.0-1) forky: resolved (fixed in 2.2.0-1) sid: resolved (fixed in 2.2.0-1) trixie: resolved (fi

CVE-2024-1441 [MEDIUM] CVE-2024-1441: libvirt - An off-by-one error flaw was found in the udevListInterfacesByStatus() function ... An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash. Scope: local

CVE-2013-6457 [MEDIUM] CVE-2013-6457: libvirt - The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_drive... The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not properly initialize the nodemap, which allows local users to cause a denial of service (invalid free operation and crash) or possibly execute arbitrary code via an inactive domain to the virsh numatune command. Scope: local bookworm: resolved (fixed

CVE-2022-0897 [MEDIUM] CVE-2022-0897: libvirt - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFi... A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via li

CVE-2013-6458 [MEDIUM] CVE-2013-6458: libvirt - Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockIn... Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command. Scope: loca

CVE-2013-4399 [MEDIUM] CVE-2013-4399: libvirt - The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, wh... The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection. Scope: local bookworm: resolved (fixed in 1.1.4-1) bul

CVE-2024-2496 [MEDIUM] CVE-2024-2496: libvirt - A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() ... A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash. Scope: local bookw

CVE-2011-2178 [MEDIUM] CVE-2011-2178: libvirt - The virSecurityManagerGetPrivateData function in security/security_manager.c in ... The virSecurityManagerGetPrivateData function in security/security_manager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users to read arbitrary files on the host OS. NOTE: this vulnerability exists because of a CVE-

CVE-2019-20485 [MEDIUM] CVE-2019-20485: libvirt - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor j... qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage). Scope: local bookworm: resolved (fixed in 6.0.0-2) bullseye: resolved (fixed in 6.0.0-2) forky: resolved (fixed in 6.0.0-2) sid: resolved (fixed in 6.0.0-2) trixie: resolved (fixed i

CVE-2013-5651 [MEDIUM] CVE-2013-5651: libvirt - The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows c... The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap, as demonstrated by a large nodeset value to numatune. Scope: local bookworm: resolved (fixed in 1.1.2~rc1-1) bullseye: resolved (fixed in 1.1.2~rc1-1) forky: resolved (fixed in 1.

CVE-2019-3886 [MEDIUM] CVE-2019-3886: libvirt - An incorrect permissions check was discovered in libvirt 4.8.0 and above. The re... An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block. Scope: local bookworm: resolved (fixed in 5.0.0-2) bullseye: resolved (fixed in 5.0.0-2) forky: r

CVE-2023-2700 [MEDIUM] CVE-2023-2700: libvirt - A vulnerability was found in libvirt. This security flaw ouccers due to repeated... A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup. Scope: local bookworm: resolved (fixed in 9.0.0-4) bullseye: resolved forky: resolved (fixed in 9.0.0-4) si

CVE-2013-4154 [MEDIUM] CVE-2013-4154: libvirt - The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not... The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to "agent based cpu (un)plug," as demonstrated by the "virsh vcpucount foobar --guest" command. Scope: local bookworm: resolved (fixed in 1.1.0-4) bullseye: resolved

CVE-2010-2239 [MEDIUM] CVE-2010-2239: libvirt - Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without settin... Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors. Scope: local bookworm: resolved (fixed in 0.8.3-1) bullseye: resolved (fixed in 0.8.3-1) forky: resolved (fixed in 0.8.3-1) sid: resolved (fixed in 0.8.3-1

CVE-2010-2238 [MEDIUM] CVE-2010-2238: libvirt - Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing ... Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors. Scope: local bookworm: resolved (fixed in 0.8.3-1) bullseye: resolved (fixed in 0.8.3