CVE-2020-25650

2020-11-2514:35:01

CWE-770

redhat

www.cve.org

spice-vdagentd

file transfers

host system

virtual machine

unix domain socket path

memory denial of service

system availability

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

23.5%

JSON

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path /run/spice-vdagentd/spice-vdagent-sock could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

CNA Affected

[
  {
    "product": "spice-vdagent",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "spice-vdagent versions prior and including 0.20"
      }
    ]
  }
]