CVE-2020-12430
Fixed in a distro release EPSS 2%
An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
Products: redhat libvirt, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | libvirt | 5.5.0-r1 |
| Alpine 3.11 | libvirt | 5.9.0-r1 |
| Alpine 3.8 | libvirt | 5.5.0-r1 |
| Alpine 3.9 | libvirt | 5.5.0-r1 |
| Debian 10 | libvirt | 5.0.0-4+deb10u2 |
| Debian 12 | libvirt | 6.4.0-2 |
| Debian 13 | libvirt | 6.4.0-2 |
| Debian 14 | libvirt | 6.4.0-2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | libvirt | 5.1.0-8.16.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP1 | libvirt | 5.1.0-8.16.1 |
| SUSE Linux Enterprise Server 12 SP5 | libvirt | 5.1.0-13.6.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | libvirt | 5.1.0-13.6.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | libvirt | 5.1.0-13.6.2 |
| Ubuntu 18.04 LTS | libvirt | 4.0.0-1ubuntu8.17 |
| Ubuntu 20.04 LTS | libvirt | 6.0.0-0ubuntu6 |
| openSUSE Tumbleweed | libvirt | 10.9.0-3.1 |