CVE-2019-3840: Null Pointer Dereference
A flaw was found in libvirtd. A null pointer in virJSONValueObjectHasKey function in util/virjson.c triggers a crash, resulting in remote denial of service via guest agent.
References:
https://bugzilla.redhat.com/showbug.cgi?id=1663051
Upstream patch:
https://www.redhat.com/archives/libvir-list/2019-January/msg00241.html
Other sources
A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-3840?
CVE-2019-3840 is a vulnerability discovered in libvirt, versions before 5.0.0, that allows an attacker in a guest VM to crash libvirtd and cause a denial of service.
How does CVE-2019-3840 affect libvirt?
CVE-2019-3840 affects libvirt by causing a NULL pointer dereference flaw in the way it gets interface information through the QEMU agent.
What is the severity level of CVE-2019-3840?
The severity level of CVE-2019-3840 is medium, with a severity value of 6.3.
How can CVE-2019-3840 be fixed?
To fix CVE-2019-3840, update libvirt to version 5.0.0 or later.
Are there any references for CVE-2019-3840?
Yes, you can find references for CVE-2019-3840 at the following links: [1](http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00101.html), [2](http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00105.html), [3](https://access.redhat.com/errata/RHSA-2019:2294)