Libvirt Security Notice: LSN-2020-0004

Double free after running guest agent command to fetch interfaces

Lifecycle

Reported on: 20200808
Published on: 20200930
Fixed on: 20200930

Credits

Reported by: Ilja Van Sprundel
Patched by: Ján Tomko

See also

Description

If the guest agent produces an errorneous reply when listing the interfaces libvirt will free a pointer twice

Impact

A malicious QEMU guest agent can trigger a libvirtd crash

Workaround

Avoid quering the guest network interfaces, or disable use of the QEMU guest agent for untrusted guests

Affected product: libvirt

Branch: master

Broken in:
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.20
v1.2.21
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v3.0.0
v3.1.0
v3.2.0
v3.3.0
v3.4.0
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.9.0
v3.10.0
v4.0.0
v4.1.0
v4.2.0
v4.3.0
v4.4.0
v4.5.0
v4.6.0
v4.7.0
v4.8.0
v4.9.0
v4.10.0
v5.0.0
v5.1.0
v5.2.0
v5.3.0
v5.4.0
v5.5.0
v5.6.0
v5.7.0
v5.8.0
v5.9.0
v5.10.0
v6.0.0
v6.1.0
v6.2.0
v6.3.0
v6.4.0
v6.5.0
v6.6.0
v6.7.0
Fixed in:
v6.8.0
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:
a63b48c5ecef077bf0f909a85f453a605600cf05

Branch: v1.2.14-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.2.15-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.2.16-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.2.17-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.2.18-maint

Broken in:
v1.2.18.1
v1.2.18.2
v1.2.18.3
v1.2.18.4
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.2.19-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.2.20-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.2.21-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.3.0-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.3.1-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.3.2-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.3.3-maint

Broken in:
v1.3.3.1
v1.3.3.2
v1.3.3.3
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.3.4-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v1.3.5-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v2.0-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v2.1-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v2.2-maint

Broken in:
v2.2.1
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v3.0-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v3.2-maint

Broken in:
v3.2.1
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v3.7-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.1-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.2-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.3-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.4-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.5-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.6-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.7-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.8-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.9-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v4.10-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v5.0-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v5.1-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v5.1.0-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v5.2-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Branch: v5.3-maint

Broken in:
Fixed in:
Broken by:
0977b8aa071de550e1a013d35e2c72615e65d520
Fixed by:

Alternative formats: [xml] [text]