Resource exhaustion in libvirt - CVE-2018-5748
Published: April 2, 2018
Vulnerability identifier: #VU11465
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5748
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to a flaw in qemu/qemu_monitor.c in libvirt. A remote attacker can supply a large QEMU reply, trigger resource exhaustion and cause the service to crash.
The weakness exists due to a flaw in qemu/qemu_monitor.c in libvirt. A remote attacker can supply a large QEMU reply, trigger resource exhaustion and cause the service to crash.
Affected software
libvirt
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Fedora
Red Hat Gluster Storage Server for On-premise
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization
libvirt
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Fedora
Red Hat Gluster Storage Server for On-premise
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization
libvirt
How to mitigate CVE-2018-5748
Install update from vendor's website.
libvirt - update to 3.7.0-4.fc27