CVE-2019-20485: Input Validation
A flaw was found in the way Libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest. It holds a monitor job while issuing the 'suspend' command to a guest-agent. A malicious guest-agent may use this flaw to block the Libvirt daemon indefinitely resulting in a DoS scenario.
Upstream patch: --------------- -> https://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=a663a860819287e041c3de672aad1d8543098ecc
Other sources
A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest, where it holds a monitor job while issuing the 'suspend' command to a guest-agent. A malicious guest-agent may use this flaw to block the libvirt daemon indefinitely, resulting in a denial of service.
qemu/qemudriver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20485?
CVE-2019-20485 is a vulnerability found in libvirt where the libvirtd daemon can be blocked indefinitely by a malicious guest-agent.
How does CVE-2019-20485 affect libvirt?
CVE-2019-20485 affects libvirt by allowing a malicious guest-agent to block the libvirtd daemon indefinitely.
What is the severity rating of CVE-2019-20485?
CVE-2019-20485 has a severity rating of 5.8 (High).
How can I fix CVE-2019-20485?
To fix CVE-2019-20485, update libvirt to version 6.0.0 or higher.
Where can I find more information about CVE-2019-20485?
You can find more information about CVE-2019-20485 at the following references: [link1], [link2], [link3].