Moderate: libvirt security update
Summary
ALSA-2023:3715: Moderate: libvirt security update. Affects libvirt versions < 9.0.0-10.2.el9_2. Fixed in 9.0.0-10.2.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libvirt library is a C API that allows for the management and interaction with virtualization capabilities on Linux and other operating systems. It also provides tools for remote management of virtualized systems.
Vulnerability Detail
A memory leak vulnerability (CVE-2023-2700) has been discovered in the libvirt library. This vulnerability occurs during the cleanup process of the virPCIVirtualFunctionList, leading to a memory leak. An attacker could potentially exploit this vulnerability to exhaust system memory, resulting in a denial of service (DoS) condition.
How To Fix
Minimum fixed version
9.0.0-10.2.el9_2
This is the first release that contains the fix.
sudo dnf update libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the provided fix by updating the libvirt package.
Conclusion
The libvirt library is affected by a memory leak vulnerability that could be exploited to cause a denial of service (DoS) condition. It is recommended to update the libvirt package to version 9.0.0-10.2.el9_2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvirt →
FAQ
The libvirt library is a C API that allows for the management and interaction with virtualization capabilities on Linux and other operating systems.
This vulnerability could be exploited by an attacker to exhaust system memory, leading to a denial of service (DoS) condition.
To fix this vulnerability, update the libvirt package to version 9.0.0-10.2.el9_2 or later.
There is no known workaround for this vulnerability. It is recommended to apply the provided fix by updating the libvirt package.
You can find more information about this vulnerability in the CVE page listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
