1. CVE-Search
  2. CVE-2020-12430
ID CVE-2020-12430
Summary An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.
References
Vulnerable Configurations
  • cpe:2.3:a:redhat:libvirt:4.10.0:-:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:4.10.0:-:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:4.10.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:4.10.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:4.10.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:4.10.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.0.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.0.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.1.0:-:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.1.0:-:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.1.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.1.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.1.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.1.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.2.0:-:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.2.0:-:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.2.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.2.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.2.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.2.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.3.0:-:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.3.0:-:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.3.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.3.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.3.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.3.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.4.0:-:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.4.0:-:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.4.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.4.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.5.0:-:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.5.0:-:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.5.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.5.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.5.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.5.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.9.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:5.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:5.10.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:libvirt:6.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:redhat:libvirt:6.0.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*
CVSS
Base: 4.0 (as of 16-06-2020 - 03:15)
Impact:
Exploitability:
CWE CWE-401
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:N/I:N/A:P
refmap via4
confirm https://security.netapp.com/advisory/ntap-20200518-0003/
fedora FEDORA-2020-5cd83efda7
misc
ubuntu USN-4371-1
Last major update 16-06-2020 - 03:15
Published 28-04-2020 - 20:15
Last modified 16-06-2020 - 03:15
Back to Top