A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.

🗓️ 08 Jun 2021 07:00:00Reported by MicrosoftType

Libvirt API flaw allows read-only users change Qemu agent timeout, risking denial of service; versions before six two zero.

Reporter	Title	Published	Views	Family All 25
AlpineLinux	CVE-2020-10701	27 May 202119:15	–	alpinelinux
CBLMariner	CVE-2020-10701 affecting package libvirt 6.1.0-6	8 Jul 202121:56	–	cbl_mariner
CBLMariner	CVE-2020-10701 affecting package libvirt for versions less than 7.10.0-1	9 Apr 202206:51	–	cbl_mariner
CNNVD	Red Hat libvirt 安全漏洞	27 May 202100:00	–	cnnvd
CNVD	Unspecified Vulnerability in Red Hat libvirt	28 May 202100:00	–	cnvd
CVE	CVE-2020-10701	27 May 202118:45	–	cve
Cvelist	CVE-2020-10701	27 May 202118:45	–	cvelist
Debian CVE	CVE-2020-10701	27 May 202118:45	–	debiancve
EUVD	EUVD-2020-3132	7 Oct 202500:30	–	euvd
Tenable Nessus	CBL Mariner 2.0 Security Update: libvirt (CVE-2020-10701)	20 Mar 202300:00	–	nessus