[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAA8xKjVm5LJHMYVWYGRU81ysLHnAMNyE106ipqcCMnKbPvxSeg@mail.gmail.com>
Date: Fri, 2 Oct 2020 11:30:01 +0200
From: Mauro Matteo Cascella <mcascell@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2020-25637 libvirt: double free in
qemuAgentGetInterfaces() in qemu_agent.c
Hello,
A double free memory issue was found to occur in the libvirt API
responsible for requesting information about network interfaces of a
running QEMU domain. This flaw affects the polkit access control
driver. Specifically, clients connecting to the read-write socket with
limited ACL permissions could use this flaw to crash the libvirt
daemon, resulting in a denial of service, or potentially escalate
their privileges on the system.
CVE-2020-25637 has been assigned for this flaw.
Fixed in libvirt v6.8.0 (2020-10-01).
Upstream commits:
* https://libvirt.org/git/?p=libvirt.git;a=commit;h=955029bd0ad7ef96000f529ac38204a8f4a96401
* https://libvirt.org/git/?p=libvirt.git;a=commit;h=50864dcda191eb35732dbd80fb6ca251a6bba923
* https://libvirt.org/git/?p=libvirt.git;a=commit;h=e4116eaa44cb366b59f7fe98f4b88d04c04970ad
* https://libvirt.org/git/?p=libvirt.git;a=commit;h=a63b48c5ecef077bf0f909a85f453a605600cf05
Credit: Ilja Van Sprundel (IOActive).
Thank you,
--
Mauro Matteo Cascella, Red Hat Product Security
6F78 E20B 5935 928C F0A8 1A9D 4E55 23B8 BB34 10B0
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
