Lucene search

RedhatCVE-2020-10701

HistoryMay 27, 2021 - 7:15 p.m.

CVE-2020-10701

2021-05-2719:15:07

CWE-862

redhat

web.nvd.nist.gov

cve-2020-10701

nvd

security

authorization

libvirt

api

qemu

timeout

denial of service

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

29.8%

JSON

A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.

Affected configurations

Nvd

Vulners

Node

redhatlibvirtRange<6.2.0

VendorProductVersionCPE
redhatlibvirt*cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	libvirt	*	cpe:2.3:a:redhat:libvirt::::::::

CNA Affected

[
  {
    "product": "libvirt",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "libvirt 6.2.0"
      }
    ]
  }
]