Resource exhaustion in libvirt - CVE-2018-1064

 

Resource exhaustion in libvirt - CVE-2018-1064

Published: April 2, 2018


Vulnerability identifier: #VU11450
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1064
CWE-ID: CWE-400
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the qemu_agent.c source code file due to an incomplete fix for CVE-2018-5748 that affects the QEMU monitor. A local attacker can consume excessive amounts of memory resources and cause the service to crash.


Affected software

libvirt
Debian Linux
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Red Hat Gluster Storage Server for On-premise
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization

How to mitigate CVE-2018-1064

Update to version 4.2.0-rc1.


External References

Related Security Bulletins