Description
Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libguestfs | 1:1.20.8-1 | — |
| Debian 13 | libguestfs | 1:1.20.8-1 | — |
| Debian 12 | libguestfs | 1:1.20.8-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libguestfs | 1.32.4-11.1 | openSUSE-SU-2024:10032-1 |
Advisories 1
- openSUSE-SU-2024:10032-1 guestfs-data-1.32.4-11.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20130529 Re: Re: CVE Request -- libguestfs (1.20.6 | 1.22.0 | 1.23.0 <= X < 1.22.1 | 1.23.1): Denial of service due to a double-free when inspecting certain guest files / images mailing-list
- https://github.com/libguestfs/libguestfs/commit/fa6a76050d82894365dfe32916903ef7fee3ffcd
- libguestfs-cve20132124-inspectfs-dos(85145) vdb-entry
- [Libguestfs] 20130528 ATTN: Denial of service attack possible on libguestfs 1.21.x, libguestfs.1.22.0 mailing-list
- [Libguestfs] 20130528 Re: ATTN: Denial of service attack possible on libguestfs 1.21.x, libguestfs.1.22.0 mailing-list
- 93724 vdb-entry
- 60205 vdb-entry