Libvirt Security Notice: LSN-2019-0002

Crash after running guest agent command to fetch interfaces

Lifecycle

Credits

See also

• CVE-2019-3840

Description

If the guest agent does not reply to the command for listing interfaces, libvirt will reference a NULL pointer trying to parse a reply that doesn't exist

Impact

A malicious QEMU guest agent can trigger a crash in the libvirtd daemon when the host admin queries guest interfaces

Workaround

Avoid quering the guest network interfaces, or disable use of the QEMU guest agent in trusted guests

Affected product: libvirt

Alternative formats: [xml] [text]