CVE-2018-1064: High severity Debian Debian Linux vulnerability
An incomplete fix for CVE-2018-5748 that affects QEMU monitor leading to a resource exhaustion but now also triggered via QEMU guest agent.
Upstream patch:
https://libvirt.org/git/?p=libvirt.git;a=commit;h=fbf31e1a4cd19d6f6e33e0937a009775cd7d9513
Other sources
libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libvirtto a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
debian/libvirtto a version that resolves this vulnerability.Fixed in 7.0.0-3+deb11u3Fixed in 7.0.0-3+deb11u4Fixed in 9.0.0-4+deb12u2Fixed in 11.3.0-3+deb13u2Fixed in 12.6.0-1 - Upgrade
Upgrade
libvirtto a version that resolves this vulnerability.Fixed in 4.2.0-rc1
Event History
Frequently Asked Questions
What is CVE-2018-1064?
CVE-2018-1064 is a vulnerability in libvirt version before 4.2.0-rc1 that can result in resource exhaustion due to an incomplete fix for CVE-2018-5748.
What is the severity of CVE-2018-1064?
CVE-2018-1064 has a low severity rating.
How does CVE-2018-1064 affect libvirt?
CVE-2018-1064 affects libvirt versions before 4.2.0-rc1 and can be triggered via the QEMU guest agent.
What is the recommended version of libvirt to avoid CVE-2018-1064?
To avoid CVE-2018-1064, it is recommended to use libvirt version 4.2.0-rc1 or later.
Where can I find more information about CVE-2018-1064?
You can find more information about CVE-2018-1064 at the following references: [1] [2] [3].