CVE-2019-3840

Publication date 27 February 2019

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libvirt	18.10 cosmic	Fixed 4.6.0-2ubuntu3.4
	18.04 LTS bionic	Fixed 4.0.0-1ubuntu8.8
	16.04 LTS xenial	Fixed 1.3.1-1ubuntu10.25
	14.04 LTS trusty	Not affected

Notes

mdeslaur

introduced in 1.2.14

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libvirt	Upstream: https://libvirt.org/git/?p=libvirt.git;a=commit;h=7cfd1fbb1332ae5df678b9f41a62156cb2e88c73

Severity score breakdown

Parameter	Value
Base score	6.3 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Changed
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-3909-1
libvirt vulnerability
14 March 2019