CVE-2020-25637-libvirt-double-free

root@kitploit: CVE-2020-25637 root@kitploit: 描述 在 libvirt API 中，存在一个双重释放内存的问题，影响版本为 6.8.0 之前的版本，该 API 负责请求正在运行的 QEMU 域的网络接口信息。这个漏洞影响了 polkit 访问控制驱动程序。具体来说，以读写方式连接到套接字且具有有限 ACL 权限的客户端可以利用此漏洞使 libvirt 守护进程崩溃，从而导致拒绝服务，或可能提升系统上的权限。该漏洞的最大威胁涉及数据的机密性、完整性以及系统的可用性。 该漏洞最重要的威胁涉及： 机密性 数据完整性 系统可用性。 漏洞评分： RedH...

SUSE CVE-2014-3633

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...

SUSE CVE-2014-8136

The 1 qemuDomainMigratePerform and 2 qemuDomainMigrateFinish2 functions in qemu/qemudriver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors...

SUSE CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with...

The vulnerability of the qemuDomainGetStatsIOThread function in the qemu_driver.c component of the Libvirt virtualization management library allows a attacker to cause a service failure.

The vulnerability of the qemuDomainGetStatsIOThread function in the qemudriver.c component of the Libvirt control library is related to improper memory release before deleting the last references. Exploiting this vulnerability allows an attacker to trigger a service failure remotely...

Ubuntu 18.04 LTS / 20.04 LTS : libvirt vulnerabilities (USN-5399-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5399-1 advisory. It was discovered that libvirt incorrectly handled certain locking operations. A local attacker could possibly use this issue to cause libvir...

Advisory ROSA-SA-2021-1899

Software: libvirt 4.5.0 OS: Cobalt 7.9 CVE-ID: CVE-2020-25637 CVE-Crit: MEDIUM CVE-DESC: A double free memory issue has been detected in libvirt APIs in versions prior to 6.8.0 responsible for querying information about network interfaces of a running QEMU domain. This flaw affects the polkit...

ALPINE-CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with...

UBUNTU-CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with...

CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with...

CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with...

CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with...

CVE-2020-25637

A double free memory issue was found to occur in the libvirt API responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions cou...

PT-2014-8426 · Red Hat +4 · Libvirt +5

Name of the Vulnerable Software and Affected Versions: libvirt affected versions not specified Description: The issue is related to the qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemu driver.c. These functions do not unlock the domain when an ACL check fails, allowing...

USN-2404-1 libvirt vulnerabilities

Pavel Hrdina discovered that libvirt incorrectly handled locking when processing the virConnectListAllDomains command. An attacker could use this issue to cause libvirtd to hang, resulting in a denial of service. CVE-2014-3657 Eric Blake discovered that libvirt incorrectly handled permissions whe...

DEBIAN-CVE-2014-3633

The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service crash or read sensitive heap information via a crafted blkiotune query, which triggers an...