45 results · Feed
-
Medium 5.5
Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile w…
-
High 7.8
Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUM…
-
High 7.8
Libvirt: swtpm privilege escalation via symlink following
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, …
-
Medium 5.5
Libvirt: information disclosure via world-readable storage volume images during clone/convert
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local us…
-
Low 2.3
Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq…
-
Medium 5.5
Libvirt: information disclosure via world-readable vm snapshots
A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.
-
Medium 5.5CVE-2025-12748 Public exploit
Libvirt: denial of service in xml parsing
A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML…
-
Medium 6.2
Libvirt: stack use-after-free in virnetclientioeventloop()
A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOE…
-
Medium 6.2
Libvirt: negative g_new0 length can lead to unbounded memory allocation
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a cra…
-
Medium 5.0
Libvirt: null pointer dereference in udevconnectlistallinterfaces()
A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw c…
-
Medium 5.5CVE-2024-1441 Public exploit
Libvirt: off-by-one error in udevlistinterfacesbystatus()
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an u…
-
Medium 5.5
A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capa…
-
Unscored —CVE-2021-3975 Public exploit
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is call…
-
Unscored —
A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driv…
-
Unscored —
A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on …
-
Unscored —
A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one…
-
Unscored —
An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoo…
-
Critical 9.3
Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability
Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.
-
Unscored —CVE-2020-25637 Public exploit
A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting …
-
Medium 6.5
A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in…
-
Unscored —
An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. …
-
High 8.8
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emu…
-
High 7.8
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to …
-
High 8.8
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSav…
-
Medium 5.9
Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execut…
-
Medium 5.6
Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution …
-
Medium 5.6
Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative exec…
-
Medium 5.6
Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing specu…
-
Medium 5.8
A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information…
-
Unscored —
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which al…
-
Medium 5.5
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addre…
-
Unscored —
libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5…
-
Unscored —
util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS…
-
Unscored —
qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU repl…
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disc…
-
Unscored —
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string,…
-
Unscored —
The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host …
-
Unscored —
Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c …
-
Unscored —
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE fl…
-
Unscored —
The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unl…