CVE-2020-25650: Medium severity red hat spice-vdagent vulnerability
A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path /run/spice-vdagentd/spice-vdagent-sock could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.
Other sources
The following flaw was reported by SUSE Security:
The spice-vdagentd maintains a hash map named activexfers that maps taskids to UNIX domain socket connections they belong to. These taskids refer to ongoing file transfers from the host to the virtual machine. An arbitrary client connected to spice-vdagentd via a UNIX domain socket can trigger an entry into this hash map, without the requirement that the client is associated with the currently active graphical session (function doagentfilexferstatus, specifically vdagentd.c:1025). There is no limit on the maximum amount of file transfers ongoing in parallel and there are no timeouts applied for a file transfer to be finished.
Therefore any unprivileged local user with access to the /run/spice-vdagentd/spice-vdagent-sock socket path can perform a memory denial-of-service by entering a large amount of entries into this hash map. The system might enter an out of memory situation, causing a denial-of-service for spice-vdagentd or even other processes in the system.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25650?
CVE-2020-25650 is a vulnerability found in the spice-vdagentd daemon, which allows unprivileged local guest users to perform a memory denial of service attack.
Who is affected by CVE-2020-25650?
The affected software includes spice-vdagent version up to and including 0.20.0, Debian Linux 9.0, Fedora 32, and Fedora 33.
What is the severity of CVE-2020-25650?
CVE-2020-25650 has a severity rating of medium with a CVSS score of 5.5.
How can I fix CVE-2020-25650?
To fix CVE-2020-25650, update your system to spice-vdagent version 0.21.0.
Where can I find more information about CVE-2020-25650?
You can find more information about CVE-2020-25650 at the following references: [Bugzilla Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=1886345), [Debian LTS Announce](https://lists.debian.org/debian-lts-announce/2021/01/msg00012.html), and [Fedora Package Announce](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GQT56LATVTB2DJOVVJOKQVMVUXYCT2VB/).