Description
Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 0.5.1-7 | — |
| Debian 13 | libvirt | 0.5.1-7 | — |
| Debian 12 | libvirt | 0.5.1-7 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | libvirt +2 | 0.3.3-14.el5_3.1 | RHSA-2009:0382 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- libvirt_proxy 0.5.1 - Local Privilege Escalation EDB-8534 · local · Apr 27, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2009:0382 Red Hat Security Advisory: libvirt security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- oval:org.mitre.oval:def:10127 vdb-entry signature
- [libvir-list] 20090128 Re: [libvirt] [PATCH] proxy: Fix use of uninitalized memory mailing-list
- [libvir-list] 20090128 Re: [libvirt] [PATCH] proxy: Fix use of uninitalized memory mailing-list
- 33724 vdb-entry
- [libvir-list] 20090127 [libvirt] [PATCH] proxy: Fix use of uninitalized memory mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=484947
- RHSA-2009:0382 vendor-advisory
- http://git.et.redhat.com/?p=libvirt.git%3Ba=commitdiff%3Bh=2bb0657e28
- [oss-security] 20090210 libvirt_proxy heads up mailing-list
- 34397 third-party-advisory