PT-2023-8981 · Libvirt+9 · Libvirt+9

Sandipan Roy · Published 2018-08-12 · Updated 2024-11-13 · CVE-2023-2700

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description A security flaw in libvirt occurs due to repeatedly querying an SR-IOV PCI device's capabilities, exposing a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g autoptr cleanup. This issue may allow an attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2023:3715

ALSA-2023:3822

ALT-PU-2018-2137

AZL-26736

AZL-34958

BDU:2024-02833

CESA-2023_3822

CVE-2023-2700

OPENSUSE-SU-2024:14490-1

RHSA-2023:3715

RHSA-2023:3822

RHSA-2023:4799

RHSA-2023_3715

RHSA-2023_3822

RLSA-2023:3715

RLSA-2023:3822

SUSE-SU-2023:2356-1

SUSE-SU-2023:2652-1

SUSE-SU-2023_2356-1

SUSE-SU-2023_2652-1

USN-6126-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Libvirt

References · 60

• https://gitlab.com/libvirt/libvirt/-/commit/6425a311b8ad19d6f9c0b315bf1d722551ea3585#874a1e768ade6ceb4538931cbc06248e73223306 · Patch
• https://osv.dev/vulnerability/ALSA-2023:3715 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6126-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-2700 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-12435.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34958 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2700 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2356-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-2700 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EVK6JKP36CHE7YAFDJNPNLTW4OWJJ7TQ · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2203653 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2023:3715 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6126-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2023-3822.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:3715 · Vendor Advisory