Double Free Memory Issue in libvirt API (CVE-2020-25637)
Summary
CVE-2020-25637: A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. Affects libvirt across 2 version ranges.
< 5bb483f93739d41fe1b92ff950d78b59fbdb043b
< 6.6.0-r3
Fixed in 6.6.0-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvirt is an open-source API library used for managing virtualization technologies, such as KVM and QEMU. It provides a convenient interface for interacting with virtualization hypervisors and managing virtual machines. The libvirt API allows users to perform various operations, including querying information about network interfaces of running QEMU domains. However, a vulnerability has been discovered in versions prior to 6.8.0, which can lead to a double free memory issue in the API. This vulnerability specifically affects the polkit access control driver, allowing clients with limited ACL permissions to crash the libvirt daemon or potentially escalate their privileges on the system. The impact of this vulnerability can result in a compromise of data confidentiality and integrity, as well as system availability.
Vulnerability Detail
The double free memory issue in the libvirt API (CVE-2020-25637) arises when requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Clients connecting to the read-write socket with limited ACL permissions can exploit this vulnerability to crash the libvirt daemon, leading to a denial of service. Additionally, there is a potential for privilege escalation on the system. The vulnerability has a CVSS score of 6.7, indicating a moderate level of severity. It is crucial to update to libvirt version 6.8.0 or later to mitigate this vulnerability.
How To Fix
Minimum fixed version
6.6.0-r3
This is the first release that contains the fix.
sudo apk add --upgrade libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of libvirt is not immediately feasible, a possible workaround is to restrict access to the libvirt API by enforcing stricter ACL permissions. This can help mitigate the risk of exploitation by limiting the clients that can connect to the read-write socket. However, this workaround may not provide complete protection and should be considered temporary until the package can be updated.
Conclusion
The double free memory issue in the libvirt API (CVE-2020-25637) poses a moderate level of risk to systems running affected versions of libvirt. It is crucial to update to libvirt version 6.8.0 or later to mitigate this vulnerability. Restricting access to the libvirt API can serve as a temporary workaround until the package can be updated. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvirt →
FAQ
libvirt is an open-source API library used for managing virtualization technologies, such as KVM and QEMU. It provides a convenient interface for interacting with virtualization hypervisors and managing virtual machines.
The vulnerability can lead to a denial of service by crashing the libvirt daemon. Additionally, it may allow an attacker to escalate their privileges on the system, compromising data confidentiality and integrity.
Versions of libvirt prior to 6.8.0 are affected by this vulnerability.
To fix this vulnerability, update the libvirt package to version 6.8.0 or later. Follow the official upgrade instructions provided by the libvirt project.
If updating immediately is not possible, you can restrict access to the libvirt API by enforcing stricter ACL permissions. However, this should be considered a temporary solution until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
