Denial of Service Vulnerability in libvirt: API Blockage Risk
Summary
ALPINE-CVE-2019-20485: qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage). Affects libvirt versions < 5.5.0-r2. Fixed in 5.5.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvirt is an open-source API, daemon, and management tool for managing platform virtualization. It provides a consistent way to manage different virtualization technologies, including QEMU, KVM, and others. The package is widely used in cloud computing and virtualization environments. However, it has been found to have a vulnerability that can lead to denial of service, impacting the availability of services relying on it.
Vulnerability Detail
The vulnerability, identified as CVE-2019-20485, exists in the qemu/qemu_driver.c file of libvirt versions prior to 6.0.0. It mishandles the holding of a monitor job during a query to a guest agent, allowing attackers to cause a denial of service by blocking the API. This can lead to significant disruptions in service availability, especially in environments where libvirt is critical for managing virtual machines.
How To Fix
Minimum fixed version
5.5.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting access to the libvirt API or implementing network-level controls to mitigate potential exploitation until the package can be updated.
Conclusion
CVE-2019-20485 is a significant vulnerability in libvirt that can lead to denial of service. Users are encouraged to update to the latest patched versions to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libvirt →
FAQ
CVE-2019-20485 is a vulnerability in libvirt that can lead to denial of service due to improper handling of monitor jobs during guest agent queries.
Versions of libvirt prior to 6.0.0 are affected, specifically in Alpine Linux v3.9, v3.10, and v3.11.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-20485 is 5.7, indicating a moderate severity level.
If immediate updates are not possible, consider implementing network-level controls or restricting access to the libvirt API as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
