CVE 2020-10701
A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.
Related bugs and status
CVE-2020-10701 (Candidate) is related to these bugs:
Bug #1745114: Please add guest uuid and guest-generic local include files
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1745114 | Please add guest uuid and guest-generic local include files | libvirt (Ubuntu) | Low | Fix Released |
Bug #1869796: vague error during upgrade
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1869796 | vague error during upgrade | libvirt (Ubuntu) | Low | Fix Released | ||
1869796 | vague error during upgrade | debhelper (Ubuntu) | Undecided | New | ||
1869796 | vague error during upgrade | debhelper (Debian) | Unknown | Confirmed | ||
1869796 | vague error during upgrade | systemd (Ubuntu) | Wishlist | Won't Fix | ||
1869796 | vague error during upgrade | systemd | Unknown | New |
Bug #1871354: apparmor denies related to nvdimms/nfit
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1871354 | apparmor denies related to nvdimms/nfit | libvirt (Ubuntu) | High | Fix Released |
Bug #1874647: [Ubuntu 20.04] Stale libvirt cache leads to VM startup failures
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1874647 | [Ubuntu 20.04] Stale libvirt cache leads to VM startup failures | libvirt (Ubuntu) | Medium | Fix Released | ||
1874647 | [Ubuntu 20.04] Stale libvirt cache leads to VM startup failures | Ubuntu on IBM z Systems | Medium | Fix Released | ||
1874647 | [Ubuntu 20.04] Stale libvirt cache leads to VM startup failures | libvirt (Ubuntu Groovy) | Medium | Fix Released | ||
1874647 | [Ubuntu 20.04] Stale libvirt cache leads to VM startup failures | libvirt (Ubuntu Focal) | Undecided | Fix Released |
Bug #1887592: virsh list hangs because of qemu-system-i386 defunct so libvirtd has to be restarted
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1887592 | virsh list hangs because of qemu-system-i386 defunct so libvirtd has to be restarted | libvirt (Ubuntu) | Medium | Fix Released |
Bug #1892736: virtiofsd enablement
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1892736 | virtiofsd enablement | libvirt (Ubuntu) | Undecided | Fix Released |
Bug #1892826: autopkgtest breaks in groovy at 6.6.0-1ubuntu1 for smoke-lxc
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1892826 | autopkgtest breaks in groovy at 6.6.0-1ubuntu1 for smoke-lxc | libvirt (Ubuntu) | Undecided | Fix Released | ||
1892826 | autopkgtest breaks in groovy at 6.6.0-1ubuntu1 for smoke-lxc | libguestfs (Ubuntu) | Undecided | Fix Released |
Bug #1927519: Mitigate libvirt: error : unable to set AppArmor profile 'libvirt-<vm-uuid>' for '/usr/bin/kvm-spice': No such file or directory
See the
CVE page on Mitre.org
for more details.