PT-2018-2213 · Libvirt+6 · Libvirt+6

Denial Berrange · Publicado 2018-03-14 · Atualizado 2024-06-15 · CVE-2018-1064

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 4.2.0-rc1

Description The issue is related to a resource exhaustion problem due to an incomplete fix that affects QEMU monitor and is also triggered via QEMU guest agent. It is associated with an error that leads to excessive memory consumption when handling a large stream of QEMU data. This could allow a remote attacker to cause a denial of service.

Recommendations For libvirt versions prior to 4.2.0-rc1, update to version 4.2.0-rc1 or later to resolve the issue.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-399

CWE-400

Identificadores relacionados

ALT-PU-2018-1530

BDU:2019-00236

CESA-2018_1396

CESA-2018_1929

CVE-2018-1064

DLA-1315-1

DSA-4137-1

MGASA-2018-0186

OPENSUSE-SU-2018_0939-1

OPENSUSE-SU-2024:11008-1

RHSA-2018:1396

RHSA-2018:1929

RHSA-2018_1396

RHSA-2018_1929

SUSE-SU-2018:0838-1

SUSE-SU-2018:0861-1

SUSE-SU-2018:0920-1

SUSE-SU-2018:1295-1

SUSE-SU-2018:2082-1

SUSE-SU-2018:2141-1

USN-3680-1

Produtos afetados

Alt Linux

Centos

Qemu

Red Hat

Suse

Ubuntu

Libvirt

Referências · 132

• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-5715.md · Exploit
• 🔥 https://github.com/opsxcq/exploit-cve-2017-5715 · Exploit
• 🔥 https://github.com/mmxsrup/CVE-2018-3639 · Exploit
• https://github.com/mathse/meltdown-spectre-bios-list · Nota
• https://github.com/tyhicks/ssbd-tools · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1064 · Nota de Segurança
• https://bugzilla.suse.com/987527 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2018:0861-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=22777 · Nota
• https://bugzilla.suse.com/1078808 · Nota
• https://debian.org/security/2018/dsa-4137 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2018/suse-su-20180861-1 · Nota
• https://lists.centos.org/pipermail/centos-announce/2018-May/034914.html · Nota
• https://bugzilla.suse.com/936233 · Nota
• https://osv.dev/vulnerability/MGASA-2018-0186 · Aviso do Fabricante