CVE-2023-2700: Medium severity red hat libvirt-daemon-driver-storage-iscsi-direct vulnerability
A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's gautoptr cleanup.
Other sources
Memory leak in virPCIVirtualFunctionList cleanup
Ref: https://bugzilla.redhat.com/showbug.cgi?id=2193311 https://gitlab.com/libvirt/libvirt/-/commit/6425a311b8ad19d6f9c0b315bf1d722551ea3585#874a1e768ade6ceb4538931cbc06248e73223306
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2700?
The severity of CVE-2023-2700 is medium.
Which software versions are affected by CVE-2023-2700?
The affected software versions include libvirt 8.0.0-1ubuntu7.5, 8.6.0-0ubuntu3.2, 9.0.0-2ubuntu1.1, 9.3.0, Redhat Libvirt 4.5.0, Fedoraproject Fedora 38, Redhat Enterprise Linux 8.0 and Redhat Enterprise Linux 9.0.
How can I fix the vulnerability in libvirt?
To fix the vulnerability in libvirt, update to the latest version provided by your software vendor.
Where can I find more information about CVE-2023-2700?
More information about CVE-2023-2700 can be found at the following references: [https://access.redhat.com/security/cve/CVE-2023-2700](access.redhat.com), [https://bugzilla.redhat.com/show_bug.cgi?id=2203653](bugzilla.redhat.com), and [https://gitlab.com/libvirt/libvirt/-/commit/6425a311b8ad19d6f9c0b315bf1d722551ea3585#874a1e768ade6ceb4538931cbc06248e73223306](gitlab.com).
What is the Common Weakness Enumeration (CWE) for CVE-2023-2700?
The Common Weakness Enumeration (CWE) for CVE-2023-2700 is CWE-401.