Description
Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 1.2.1-1 | — |
| Debian 13 | libvirt | 1.2.1-1 | — |
| Debian 12 | libvirt | 1.2.1-1 | — |
| Debian 7 | libvirt | 0.9.12.3-1 | DSA-2846-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libvirt +4 | 0.10.2-29.el6_5.3 | RHSA-2014:0103 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libvirt | 2.5.0-1.1 | openSUSE-SU-2024:10209-1 |
Advisories 3
- RHSA-2014:0103 Red Hat Security Advisory: libvirt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2846-1 libvirt - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10209-1 libvirt-2.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-2093-1 vendor-advisory
- 56446 third-party-advisory
- DSA-2846 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1043069
- http://libvirt.org/news.html
- 60895 third-party-advisory
- GLSA-201412-04 vendor-advisory
- openSUSE-SU-2014:0268 vendor-advisory
- RHSA-2014:0103 vendor-advisory
- 56186 third-party-advisory
- openSUSE-SU-2014:0270 vendor-advisory