Description
A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libvirt | libvirt | >= 3.10.0, < 6.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 6.0.0-2 | — |
| Debian 13 | libvirt | 6.0.0-2 | — |
| Debian 12 | libvirt | 6.0.0-2 | — |
| Debian 10 | libvirt | 5.0.0-4+deb10u2 | DLA-3778-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libvirt | 4.0.0-1ubuntu8.17 | USN-4371-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | SLOF | 20191022-3.git899d9883.module+el8.3.0+6423+e4cb6418 | RHSA-2020:4676 |
| RHEL 8 | hivex +6 | 1.3.18-20.module+el8.3.0+6423+e4cb6418 | RHSA-2020:4676 |
| RHEL 8 | libguestfs-winsupport | 8.2-1.module+el8.3.0+6423+e4cb6418 | RHSA-2020:4676 |
| RHEL 8 | libiscsi +2 | 1.18.0-8.module+el8.1.0+4066+0f1aadab | RHSA-2020:4676 |
| RHEL 8 | libnbd +5 | 1.2.2-1.module+el8.3.0+7353+9de0a3cc | RHSA-2020:4676 |
| RHEL 8 | libvirt +28 | 6.0.0-28.module+el8.3.0+7827+5e65edd7 | RHSA-2020:4676 |
| RHEL 8 | libvirt-dbus | 1.3.0-2.module+el8.3.0+6423+e4cb6418 | RHSA-2020:4676 |
| RHEL 8 | nbdkit +13 | 1.16.2-4.module+el8.3.0+6922+fd575af8 | RHSA-2020:4676 |
| RHEL 8 | netcf +2 | 0.2.8-12.module+el8.1.0+4066+0f1aadab | RHSA-2020:4676 |
| RHEL 8 | perl-Sys-Virt +2 | 6.0.0-1.module+el8.3.0+6423+e4cb6418 | RHSA-2020:4676 |
| RHEL 8 | qemu-img +10 | 15:4.2.0-34.module+el8.3.0+7976+077be4ec | RHSA-2020:4676 |
| RHEL 8 | seabios +2 | 1.13.0-2.module+el8.3.0+7353+9de0a3cc | RHSA-2020:4676 |
| RHEL 8 | sgabios +1 | 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab | RHSA-2020:4676 |
| RHEL 8 | supermin +1 | 5.1.19-10.module+el8.3.0+6423+e4cb6418 | RHSA-2020:4676 |
| RHEL 8 | virt-dib +25 | 1:1.40.2-25.module+el8.3.0+7421+642fe24f | RHSA-2020:4676 |
| RHEL 7 | libvirt +30 | 4.5.0-36.el7 | RHSA-2020:4000 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | hivex +6 | 1.3.18-20.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | libguestfs-winsupport | 8.2-1.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | libiscsi +2 | 1.18.0-8.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | libnbd +5 | 1.2.2-1.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | libvirt +24 | 6.0.0-28.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | libvirt-dbus | 1.3.0-2.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | nbdkit +13 | 1.16.2-4.module_el8.5.0+2608+72063365 | ALSA-2020:4676 |
| AlmaLinux 8 | netcf +2 | 0.2.8-12.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | ocaml-libguestfs +1 | 1:1.40.2-25.module_el8.3.0+2048+e7a0a3ea.alma | ALSA-2020:4676 |
| AlmaLinux 8 | perl-Sys-Virt +1 | 6.0.0-1.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | seabios +2 | 1.13.0-2.module_el8.5.0+2608+72063365 | ALSA-2020:4676 |
| AlmaLinux 8 | sgabios | 1:0.20170427git-3.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:4676 |
| AlmaLinux 8 | sgabios-bin | 1:0.20170427git-3.module_el8.5.0+2608+72063365 | ALSA-2020:4676 |
| AlmaLinux 8 | supermin +1 | 5.1.19-10.module_el8.5.0+2608+72063365 | ALSA-2020:4676 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | hivex | 1.3.18-20.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | libguestfs-winsupport | 8.2-1.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | libiscsi | 1.18.0-8.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | libnbd | 1.2.2-1.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | libvirt-dbus | 1.3.0-2.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | nbdkit | 1.16.2-4.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | netcf | 0.2.8-12.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | perl-Sys-Virt +1 | 6.0.0-1.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | seabios | 1.13.0-2.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | sgabios | 1:0.20170427git-3.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
| Rocky Linux 8 | supermin | 5.1.19-10.module+el8.4.0+534+4680a14e | RLSA-2020:4676 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | libvirt | 5.1.0-8.16.1 | SUSE-SU-2020:1208-1 |
| SLES 15 | libvirt | 4.0.0-9.32.1 | SUSE-SU-2020:1250-1 |
| SLES 12 SP5 | libvirt | 5.1.0-13.6.2 | SUSE-SU-2020:1277-1 |
| SLES 12 SP4 | libvirt | 4.0.0-8.20.2 | SUSE-SU-2020:1289-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 | libvirt | 4.0.0-9.32.1 | SUSE-SU-2020:1250-1 |
| SLES for SAP 12 SP5 | libvirt | 5.1.0-13.6.2 | SUSE-SU-2020:1277-1 |
| SLES for SAP 12 SP4 | libvirt | 4.0.0-8.20.2 | SUSE-SU-2020:1289-1 |
| SLE HPC 15 | libvirt | 4.0.0-9.32.1 | SUSE-SU-2020:1250-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | libvirt +30 | 4.5.0-36.amzn2.2 | ALAS2-2020-1557 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | hivex +6 | 1.3.18-20.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | libguestfs-winsupport | 8.2-1.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | libiscsi +2 | 1.18.0-8.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | libnbd +5 | 1.2.2-1.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | libvirt +28 | 6.0.0-28.0.1.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | libvirt-dbus | 1.3.0-2.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | nbdkit +13 | 1.16.2-4.0.1.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | netcf +2 | 0.2.8-12.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | perl-Sys-Virt +1 | 6.0.0-1.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | qemu-img +10 | 15:4.2.0-34.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | seabios +2 | 1.13.0-2.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | sgabios +1 | 1:0.20170427git-3.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | supermin +1 | 5.1.19-10.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 8 | virt-dib +25 | 1:1.40.2-25.0.1.module+el8.3.0+7860+a7792d29 | ELSA-2020-4676 |
| Oracle Linux 7 | libvirt +30 | 4.5.0-36.el7 | ELSA-2020-4000 |
Advisories 14
- ALSA-2020:4676 Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 5, 2026
- RHSA-2020:4676 Red Hat Security Advisory: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2020:4000 Red Hat Security Advisory: libvirt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-4371-1 libvirt vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-3778-1 libvirt - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2020:4676 Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2020:1208-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1277-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1289-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1250-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0747 libvirt: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 2, 2024
- ALAS2-2020-1557 Moderate: libvirt security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 11, 2020
- ELSA-2020-4676 Moderate: virt:ol and virt-devel:rhel security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
- ELSA-2020-4000 Moderate: libvirt security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 6, 2020
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10703
- https://bugzilla.redhat.com/show_bug.cgi?id=1790725 vendor-advisory
- https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=dfff16a7c261f8d28e3abe60a47165f845fa952f
- https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=5d5c732d748d644ec14626bce448e84bdc4bd93e
- https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129
- https://security.netapp.com/advisory/ntap-20200608-0005/
- FEDORA-2020-5cd83efda7 vendor-advisory
- [debian-lts-announce] 20240401 [SECURITY] [DLA 3778-1] libvirt security update mailing-list