| Reported on: | 20200114 |
|---|---|
| Published on: | 20200114 |
| Fixed on: | 20191222 |
| Reported by: | Yi Li |
|---|---|
| Han Han | |
| Patched by: | Yi Li |
The implementation of the virStoragePoolLookupByTargetPath API crashed on network-based storage pools with missing target paths.
A read-only client can cause a denial of service attack against a privileged client by crashing libvirtd if such a pool is known to libvirtd.
The crash only happens on hosts with network-based storaged pools without a target path. Denying access to the readonly libvirt socket will avoid the potential for a denial of service attack, but will not prevent the out-of-bounds access from causing a crash for a privileged client, although such a crash is no longer a security problem.