CoreCVE
Back

MEDIUM

libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent

Published Mar 19, 2020

Description

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

Affected products

Remediation

Red Hat statement

This issue affects the version of the libvirt package as shipped with Red Hat Enterprise Linux 7, 8 and Red Hat Enterprise Linux Advanced Virtualization 8. Future libvirt updates for Red Hat Enterprise Linux 7, 8 and Red Hat Enterprise Linux Advanced Virtualization 8 may address this issue. Red Hat Enterprise Linux version 5 and 6 are in Maintenance Support 2 Phase of the life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of the Red Hat Enterprise Linux version 5 and 6. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Mar 19, 2020
Updated Aug 5, 2024
Reserved Mar 1, 2020
Link CVE-2019-20485
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-20485
Red Hat
Severity Moderate
Public date Dec 5, 2019
Links CVE-2019-20485 - Bugzilla
ENISA EUVD
Assigner mitre
Published Mar 19, 2020
Updated Aug 5, 2024
Exploited since n/a
Link EUVD-2019-11029
EUVD-2019-11029