Resource exhaustion in libvirt - CVE-2018-1064
Published: April 2, 2018
Vulnerability identifier: #VU11450
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1064
CWE-ID: CWE-400
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists in the qemu_agent.c source code file due to an incomplete fix for CVE-2018-5748 that affects the QEMU monitor. A local attacker can consume excessive amounts of memory resources and cause the service to crash.
Affected software
libvirt
Debian Linux
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Red Hat Gluster Storage Server for On-premise
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization
Debian Linux
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Red Hat Gluster Storage Server for On-premise
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization
How to mitigate CVE-2018-1064
Update to version 4.2.0-rc1.