CVE-2019-20485

Publication date 19 March 2020

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libvirt	20.04 LTS focal	Not affected
	19.10 eoan	Ignored
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Notes

mdeslaur

it appears this CVE is only for the suspend job because it is the only one that doesn't require write permissions. In libvirt in bionic and older, there was no support for running both agent monitor jobs and normal monitor jobs at the same. Support for doing so was introduced in the following commit: https://gitlab.com/libvirt/libvirt/-/commit/4621350f6d3dbca57bbd97829ff5d4efc3a51c97 As such, it would not appear that a malicious guest agent would be able to block jobs in bionic and earlier, so marking as not-affected.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libvirt	Upstream: https://libvirt.org/git/?p=libvirt.git;a=commit;h=cc1d1dbbd5fa18876a5ca8ac99a991b32ad49409 Upstream: https://libvirt.org/git/?p=libvirt.git;a=commit;h=a663a860819287e041c3de672aad1d8543098ecc

Severity score breakdown

Parameter	Value
Base score	5.7 · Medium
Attack vector	Adjacent
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H