Description
An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 6.4.0-2 | — |
| Debian 13 | libvirt | 6.4.0-2 | — |
| Debian 12 | libvirt | 6.4.0-2 | — |
| Debian 10 | libvirt | 5.0.0-4+deb10u2 | DLA-3778-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libvirt | 6.0.0-0ubuntu6 | — |
| Ubuntu 18.04 LTS | libvirt | 4.0.0-1ubuntu8.17 | USN-4371-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | libvirt | 5.1.0-8.16.1 | SUSE-SU-2020:1208-1 |
| SLES 12 SP5 | libvirt | 5.1.0-13.6.2 | SUSE-SU-2020:1277-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | libvirt | 5.1.0-13.6.2 | SUSE-SU-2020:1277-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libvirt | 10.9.0-3.1 | openSUSE-SU-2024:14490-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.11 | libvirt | 5.9.0-r1 | — |
| Alpine v3.10 | libvirt | 5.5.0-r1 | — |
| Alpine v3.9 | libvirt | 5.5.0-r1 | — |
| Alpine v3.8 | libvirt | 5.5.0-r1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libvirt +31 | 5.7.0-15.el7 | ELSA-2020-5720, ELSA-2020-5719 |
Advisories 8
- USN-4371-1 libvirt vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-3778-1 libvirt - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2020:1208-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1277-1 Security update for libvirt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14490-1 libvirt-10.9.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0748 libvirt: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 17, 2024
- ELSA-2020-5720 Important: libvirt security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 11, 2020
- ELSA-2020-5719 Important: libvirt security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 11, 2020
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1804548
- https://bugzilla.redhat.com/show_bug.cgi?id=1828190
- https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=9bf9e0ae6af38c806f4672ca7b12a6b38d5a9581
- https://security.netapp.com/advisory/ntap-20200518-0003/
- USN-4371-1 vendor-advisory
- FEDORA-2020-5cd83efda7 vendor-advisory
- [debian-lts-announce] 20240401 [SECURITY] [DLA 3778-1] libvirt security update mailing-list