PT-2023-8981 · Libvirt+9 · Libvirt+9

Sandipan Roy · Publicado 2018-08-12 · Atualizado 2024-11-13 · CVE-2023-2700

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description A security flaw in libvirt occurs due to repeatedly querying an SR-IOV PCI device's capabilities, exposing a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g autoptr cleanup. This issue may allow an attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Enumeração de Fraquezas

CWE-401

Identificadores relacionados

ALSA-2023:3715

ALSA-2023:3822

ALT-PU-2018-2137

AZL-26736

AZL-34958

BDU:2024-02833

CESA-2023_3822

CVE-2023-2700

OPENSUSE-SU-2024:14490-1

RHSA-2023:3715

RHSA-2023:3822

RHSA-2023:4799

RHSA-2023_3715

RHSA-2023_3822

RLSA-2023:3715

RLSA-2023:3822

SUSE-SU-2023:2356-1

SUSE-SU-2023:2652-1

SUSE-SU-2023_2356-1

SUSE-SU-2023_2652-1

USN-6126-1

Produtos afetados

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Libvirt

Referências · 60

• https://bugzilla.suse.com/1183247 · Nota
• https://suse.com/security/cve/CVE-2023-2700 · Nota
• https://gitlab.com/libvirt/libvirt/-/commit/6425a311b8ad19d6f9c0b315bf1d722551ea3585#874a1e768ade6ceb4538931cbc06248e73223306 · Correção
• https://suse.com/security/cve/CVE-2020-12430 · Nota
• https://osv.dev/vulnerability/ALSA-2023:3715 · Aviso do Fabricante
• https://bugzilla.suse.com/1199583 · Nota
• https://osv.dev/vulnerability/USN-6126-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2700 · Aviso do Fabricante
• https://t.me/cvenotify/51113 · Publicação no Telegram
• https://linux.oracle.com/errata/ELSA-2024-12435.html · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-34958 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-2700 · Aviso do Fabricante
• https://bugzilla.suse.com/1208567 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2023:2356-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2023/suse-su-20232652-1 · Nota