Bug 713334

Summary:	<app-emulation/libvirt-6.0.0: Denial of service in qemu_driver.c (CVE-2019-20485)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	normal	CC:	tamiko, virtualization
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	?? [glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	711524
Bug Blocks:

Description Sam James archtester

2020-03-19 03:21:04 UTC

Description:
"qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage)."

"A flaw was found in the way Libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest. It holds a monitor job while issuing the 'suspend' command to a guest-agent. A malicious guest-agent may use this flaw to block the Libvirt daemon indefinitely resulting in a DoS scenario."

Patch: https://libvirt.org/git/?p=libvirt.git;a=commit;h=a663a860819287e041c3de672aad1d8543098ecc

Comment 1 Sam James archtester

2020-03-19 03:37:26 UTC


*** This bug has been marked as a duplicate of bug 711524 ***