Summary
It was discovered that libvirt incorrectly handled guest reboots in the
libxl driver. An attacker in a guest could possibly use this issue to
cause the libvirt daemon to crash, resulting in a denial of service. This
issue only affected Ubuntu 16.04 LTS. (CVE-2021-4147)
Alexander Kuznetsov discovered that libvirt incorrectly handled listing
network interfaces. An attacker could possibly use this issue to cause
the libvirt daemon to crash, resulting in a denial of service. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2024-1441)
It was discovered that libvirt incorrectly handled certain values in its
RPC library. An attacker could possibly use this issue to cause the
libvirt daemon to crash, resulting in a denial of service. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2024-2494)
It was discovered that libvirt incorrectly handled listing network
interfaces under certain circumstances. An attacker could possibly use
this issue to cause the libvirt daemon to crash, resulting in a denial of
service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. (CVE-2024-2496)
It was discovered that libvirt incorrectly set permissions on external
inactive snapshots, making them world-readable. A local attacker could
possibly use this issue to obtain sensitive information. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu
20.04 LTS. (CVE-2025-13193)
It was discovered that libvirt incorrectly handled certain characters in
virtual network definitions. An authenticated user could possibly use
this issue to inject arbitrary configuration directives and execute
arbitrary code as root. This issue did not affect Ubuntu 14.04 LTS.
(CVE-2026-61477)
It was discovered that libvirt incorrectly handled certain XML input. An
attacker could possibly use this issue to cause the libvirt daemon to
crash, resulting in a denial of service. (CVE-2026-61478)
He Wei discovered that libvirt incorrectly followed symbolic links when
changing file ownership. A local attacker could possibly use this issue
to escalate privileges. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63622)
It was discovered that libvirt incorrectly set permissions on images
during storage volume clone and convert operations, making them
temporarily world-readable. A local attacker could possibly use this
issue to obtain sensitive information. (CVE-2026-63623)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libvirt | 8.0.0-1ubuntu7.19 |
| Ubuntu · 24.04 LTS 24.04:LTS | libvirt | 10.0.0-2ubuntu8.16 |
| Ubuntu · 26.04 LTS 26.04:LTS | libvirt | 12.0.0-1ubuntu5.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libvirt | 1.2.2-0ubuntu13.1.28+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libvirt | 1.3.1-1ubuntu10.31+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libvirt | 4.0.0-1ubuntu8.21+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libvirt | 6.0.0-0ubuntu8.20+esm1 |
Vulnerabilities 8
-
High 7.8
Libvirt: swtpm privilege escalation via symlink following
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, …
-
Medium 6.2
Libvirt: negative g_new0 length can lead to unbounded memory allocation
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a cra…
-
Medium 5.5CVE-2024-1441 Public exploit
Libvirt: off-by-one error in udevlistinterfacesbystatus()
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an u…
-
Medium 5.5
Libvirt: information disclosure via world-readable vm snapshots
A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.
-
Medium 5.5
Libvirt: information disclosure via world-readable storage volume images during clone/convert
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local us…
-
Medium 5.0
Libvirt: null pointer dereference in udevconnectlistallinterfaces()
A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw c…
-
Low 2.3
Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq…
-
Unscored —
A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on …
References
-
report
https://ubuntu.com/security/CVE-2021-4147
-
report
https://ubuntu.com/security/CVE-2024-1441
-
report
https://ubuntu.com/security/CVE-2024-2494
-
report
https://ubuntu.com/security/CVE-2024-2496
-
report
https://ubuntu.com/security/CVE-2025-13193
-
report
https://ubuntu.com/security/CVE-2026-61477
-
report
https://ubuntu.com/security/CVE-2026-61478
-
report
https://ubuntu.com/security/CVE-2026-63622
-
report
https://ubuntu.com/security/CVE-2026-63623