Double Free in libvirt - CVE-2020-25637

Vulnerability identifier: #VU48591

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-25637

CWE-ID: CWE-415

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in the libvirt API, responsible for requesting information about network interfaces of a running QEMU domain. A local client connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system.

libvirt
Arch Linux
Gentoo Linux
CentOS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Ubuntu
openEuler
libvirt (Alpine package)
libvirt-daemon (Ubuntu package)
libvirt-daemon-system (Ubuntu package)
libvirt0 (Ubuntu package)
libvirt (Red Hat package)
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-storage
libvirt-daemon
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-interface
libvirt-daemon-driver-network
libvirt-daemon-qemu
libvirt-daemon-driver-storage-iscsi
libvirt-client
libvirt-lock-sanlock
libvirt-daemon-config-network
libvirt-daemon-kvm
libvirt-docs
libvirt-wireshark
libvirt-admin
libvirt-libs
libvirt-daemon-driver-secret
libvirt-bash-completion
libvirt-daemon-driver-storage-mpath
libvirt
libvirt-debuginfo
libvirt-daemon-driver-storage-rbd
libvirt-daemon-config-nwfilter
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-core
libvirt-debugsource
libvirt-daemon-driver-nwfilter
libvirt-nss
libvirt-daemon-driver-storage-logical
libvirt-devel
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-qemu
dev-python/libvirt-python
app-emulation/libvirt
Red Hat Enterprise Linux Advanced Virtualization
Red Hat OpenShift Container Platform

Install updates from vendor's website.

libvirt - update to 6.8.0
libvirt-daemon (Ubuntu package) - addressed in versions 4.0.0-1ubuntu8.21, 6.0.0-0ubuntu8.16, 7.6.0-0ubuntu1.2
libvirt-daemon-system (Ubuntu package) - addressed in versions 4.0.0-1ubuntu8.21, 6.0.0-0ubuntu8.16, 7.6.0-0ubuntu1.2
libvirt0 (Ubuntu package) - addressed in versions 4.0.0-1ubuntu8.21, 6.0.0-0ubuntu8.16, 7.6.0-0ubuntu1.2
libvirt (Red Hat package) - update to 4.5.0-36.el7_9.3
Red Hat OpenShift Container Platform - update to 4.5.20
libvirt-daemon-driver-nodedev - update to 6.2.0-8
libvirt-daemon-driver-storage - update to 6.2.0-8
libvirt-daemon - update to 6.2.0-8
libvirt-daemon-driver-storage-iscsi-direct - update to 6.2.0-8
libvirt-daemon-driver-storage-gluster - update to 6.2.0-8
libvirt-daemon-driver-interface - update to 6.2.0-8
libvirt-daemon-driver-network - update to 6.2.0-8
libvirt-daemon-qemu - update to 6.2.0-8
libvirt-daemon-driver-storage-iscsi - update to 6.2.0-8
libvirt-client - update to 6.2.0-8
libvirt-lock-sanlock - update to 6.2.0-8
libvirt-daemon-config-network - update to 6.2.0-8
libvirt-daemon-kvm - update to 6.2.0-8
libvirt-docs - update to 6.2.0-8
libvirt-wireshark - update to 6.2.0-8
libvirt-admin - update to 6.2.0-8
libvirt-libs - update to 6.2.0-8
libvirt-daemon-driver-secret - update to 6.2.0-8
libvirt-bash-completion - update to 6.2.0-8
libvirt-daemon-driver-storage-mpath - update to 6.2.0-8
libvirt - update to 6.2.0-8
libvirt-debuginfo - update to 6.2.0-8
libvirt-daemon-driver-storage-rbd - update to 6.2.0-8
libvirt-daemon-config-nwfilter - update to 6.2.0-8
libvirt-daemon-driver-storage-scsi - update to 6.2.0-8
libvirt-daemon-driver-storage-core - update to 6.2.0-8
libvirt-debugsource - update to 6.2.0-8
libvirt-daemon-driver-nwfilter - update to 6.2.0-8
libvirt-nss - update to 6.2.0-8
libvirt-daemon-driver-storage-logical - update to 6.2.0-8
libvirt-devel - update to 6.2.0-8
libvirt-daemon-driver-storage-disk - update to 6.2.0-8
libvirt-daemon-driver-qemu - update to 6.2.0-8
dev-python/libvirt-python - update to 8.2.0
app-emulation/libvirt - update to 8.2.0

• Exploit #4926 - CVE-2020-25637-libvirt-double-free (Double Free) (December 11, 2020)

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00072.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00073.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1881037

• Privilege escalation in libvirt
• CentOS 7 update for libvirt
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Double Free in libvirt (Alpine package)
• Arch Linux update for libvirt
• Ubuntu update for libvirt
• Gentoo update for libvirt
• Red Hat Enterprise Linux 7 update for libvirt
• openEuler 20.03 LTS update for libvirt
• Advanced Virtualization for RHEL 8 update for the virt:8.2 and virt-devel:8.2 modules