Libvirt Security Notice: LSN-2018-0004

QEMU agent denial of service

Lifecycle

Credits

See also

• CVE-2018-1064

Description

The libvirt code that reads data from the QEMU guest agent will read data until encountering a newline, buffering all data in memory with no upper limit applied.

Impact

A malicious guest administrator can cause the libvirtd daemon to consume an arbitrary amount of memory by sending lots of data without any newline characters.

Workaround

Remove the guest agent configuration from any virtual machine that is untrustworthy and reboot it

Affected product: libvirt

Alternative formats: [xml] [text]