libvirt vulnerabilities and fixes

Recent CVEs affecting libvirt, with upgrade or downgrade steps. 31 tracked.

libvirt has 31 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 27. Most recent: 2024-08-30. Highest priority: CVE-2018-5748 (score 58/100).

• CVE-2024-8235 MEDIUM 6.2 UPGRADE A flaw was found in libvirt
• CVE-2024-2496 MEDIUM 5.0 UPGRADE MITIGATE A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt
• CVE-2023-3750 MEDIUM 6.5 MITIGATE MITIGATE A flaw was found in libvirt
• CVE-2023-2700 MEDIUM 5.5 DOWNGRADE MITIGATE A vulnerability was found in libvirt
• CVE-2022-0897 MEDIUM 4.3 UPGRADE MITIGATE A flaw was found in the libvirt nwfilter driver
• CVE-2021-4147 MEDIUM 6.5 UPGRADE MITIGATE A flaw was found in the libvirt libxl driver
• CVE-2021-3975 MEDIUM 6.5 UPGRADE MITIGATE A use-after-free flaw was found in libvirt
• CVE-2021-3667 MEDIUM 6.5 UPGRADE MITIGATE An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt
• CVE-2021-3631 MEDIUM 6.3 UPGRADE DOWNGRADE A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels
• CVE-2021-3559 MEDIUM 6.5 UPGRADE MITIGATE A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0
• CVE-2020-25637 MEDIUM 6.7 UPGRADE MITIGATE A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for re
• CVE-2020-14339 HIGH 8.8 UPGRADE MITIGATE A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process
• CVE-2020-14301 MEDIUM 6.5 UPGRADE MITIGATE An information disclosure vulnerability was found in libvirt in versions before 6.3.0
• CVE-2020-12430 MEDIUM 6.5 UPGRADE MITIGATE An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x befor
• CVE-2020-10703 MEDIUM 6.5 UPGRADE A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and
• CVE-2020-10701 MEDIUM 6.5 UPGRADE A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response tim
• CVE-2019-3886 MEDIUM 5.4 UPGRADE MITIGATE An incorrect permissions check was discovered in libvirt 4.8.0 and above
• CVE-2019-3840 MEDIUM 5.8 UPGRADE MITIGATE A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface in
• CVE-2019-20485 MEDIUM 5.7 UPGRADE MITIGATE qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest a
• CVE-2019-10168 HIGH 7.8 UPGRADE MITIGATE The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 a
• CVE-2019-10167 HIGH 7.8 UPGRADE MITIGATE The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept
• CVE-2019-10166 HIGH 7.8 UPGRADE MITIGATE It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly cl
• CVE-2019-10161 HIGH 7.8 UPGRADE MITIGATE It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the vir
• CVE-2019-10132 HIGH 8.8 UPGRADE MITIGATE A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd
• CVE-2018-6764 HIGH 7.8 MITIGATE MITIGATE util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local
• CVE-2018-5748 HIGH 7.5 MITIGATE MITIGATE qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large
• CVE-2018-1064 HIGH 7.5 MITIGATE UPGRADE libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for C
• CVE-2017-2635 HIGH 7.7 UPGRADE A NULL pointer deference flaw was found in the way libvirt from 2.5.0 to 3.0.0 handled empty drives
• CVE-2017-1000256 HIGH 8.1 UPGRADE MITIGATE libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEM
• CVE-2016-10746 HIGH 7.5 UPGRADE MITIGATE libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connec
• CVE-2015-5160 MEDIUM 5.5 UPGRADE DOWNGRADE libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD),

FAQ

How do I fix libvirt vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is libvirt being exploited right now?

None of the tracked libvirt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which libvirt CVE should I patch first?

CVE-2018-5748 currently ranks highest (58/100): qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large .

RSS feed for libvirt · ← Back to latest CVEs