Denial of service in libvirt

Published: 2020-03-19 | Updated: 2020-05-23

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2019-20485 CVE-2020-10703
CWE-ID	CWE-399
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	libvirt Universal components / Libraries / Libraries used by multiple products
Vendor	libvirt.org

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

Updated: 23.05.2020

Added vulnerability #2.

1) Resource management error

EUVDB-ID: #VU27545

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-20485

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources with the qemu/qemu_driver.c in libvirt while holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

libvirt: 4.0.0 - 5.10.0

CPE2.3

External links

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953078
https://bugzilla.redhat.com/show_bug.cgi?id=1809740
https://libvirt.org/git/?p=libvirt.git;a=commit;h=a663a860819287e041c3de672aad1d8543098ecc
https://security-tracker.debian.org/tracker/CVE-2019-20485
https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1730509.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource management error

EUVDB-ID: #VU28191

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-10703

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources with the application when performing pool lookups within the storagePoolLookupByTargetPath() function in storage/storage_driver.c. A remote user can create a pool with empty target path and then perform search for an empty target, which results in libvirt crash.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

libvirt: 3.10.0 - 5.10.0

CPE2.3

External links

https://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=dfff16a7c261f8d28e3abe60a47165f845fa952f;hp=7a7d36055ce7c161e9309c7bad7f8e61be31c5b8
https://bugzilla.redhat.com/show_bug.cgi?id=1790725

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.