PT-2020-16149 · Red Hat +7 · Spice-Vdagent +8

Matthias Gerstner · Published 2020-11-03 · Updated 2023-05-21 · CVE-2020-25653

Positive Technologies · (AI Summary)

CVSS v3.1

6.4

6.4

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions:

spice-vdagent versions 0.20 and prior

Description:

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability.

Recommendations:

For spice-vdagent versions 0.20 and prior, consider disabling the spice-vdagentd daemon until a patch is available to prevent potential denial of service or information leakage. Restrict access to the spice-vdagentd daemon to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALSA-2021:1791

ALT-PU-2021-1106

ALT-PU-2021-1155

ALT-PU-2023-1838

CESA-2021_1791

CVE-2020-25653

DLA-2524-1

MGASA-2020-0474

OPENSUSE-SU-2021:2614-1

OPENSUSE-SU-2021_2614-1

RHSA-2021:1791

RHSA-2021_1791

RLSA-2021:1791

SUSE-SU-2020:3268-1

SUSE-SU-2021:2614-1

SUSE-SU-2021:2766-1

SUSE-SU-2021:2803-1

USN-4617-1

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Spice-Vdagent

References · 78

• 🔥 https://openwall.com/lists/oss-security/2020/11/04/1 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2020:3268-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25653 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25651 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25650 · Security Note
• https://security-tracker.debian.org/tracker/DLA-2524-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2614-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25653 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-1791.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2023-1838 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-25653 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25650 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25653 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:1791 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0474 · Vendor Advisory