6.5

CVE-2020-12430

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Libvirt Version >= 4.10.0 < 6.1.0
Redhat ≫ Enterprise Linux Version8.0 SwEditionadvanced_virtualization
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.29% 0.81
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:N/A:P
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMKTKP2NYED2/
https://bugzilla.redhat.com/show_bug.cgi?id=1804548
Vendor Advisory
Issue Tracking
Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=1828190
Patch
Vendor Advisory
Issue Tracking
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=9bf9e0ae6af38c806f4672ca7b12a6b38d5a9581
https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
https://security.netapp.com/advisory/ntap-20200518-0003/
https://usn.ubuntu.com/4371-1/