Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 713334 - <app-emulation/libvirt-6.0.0: Denial of service in qemu_driver.c (CVE-2019-20485)
Summary: <app-emulation/libvirt-6.0.0: Denial of service in qemu_driver.c (CVE-2019-20...
Status: RESOLVED DUPLICATE of bug 711524
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ?? [glsa?]
Keywords:
Depends on: CVE-2019-20485
Blocks:
  Show dependency tree
 
Reported: 2020-03-19 03:21 UTC by Sam James
Modified: 2020-05-06 22:24 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-19 03:21:04 UTC
Description:
"qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage)."

"A flaw was found in the way Libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest. It holds a monitor job while issuing the 'suspend' command to a guest-agent. A malicious guest-agent may use this flaw to block the Libvirt daemon indefinitely resulting in a DoS scenario."

Patch: https://libvirt.org/git/?p=libvirt.git;a=commit;h=a663a860819287e041c3de672aad1d8543098ecc
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-19 03:37:26 UTC

*** This bug has been marked as a duplicate of bug 711524 ***