CVE-2020-25637 Use after free in libvirt
A double free in libvirt allows authenticated clients to crash the daemon or escalate privileges, impacting system availability and integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25637?
CVE-2020-25637 is a medium-severity use after free vulnerability in Opensuse Leap, published on 6 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Weakness: CWE-415
Which versions are affected by CVE-2020-25637?
It affects 2 products.
Linux distribution packages (40)
libvirt Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-admin Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-bash-completion Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-client Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-config-network Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-config-nwfilter Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-interface Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-lxc Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-network Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-nodedev Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-nwfilter Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-qemu Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-secret Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage-core Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage-disk Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage-gluster Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage-iscsi Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage-logical Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage-mpath Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage-rbd Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-storage-scsi Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-kvm Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-lxc Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-devel Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-docs Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-libs Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-lock-sanlock Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-login-shell Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-nss Red Hat:enterprise_linux:7::client | All versions | 0:4.5.0-36.el7_9.3 |
libvirt Red Hat:enterprise_linux:7::computenode | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-admin Red Hat:enterprise_linux:7::computenode | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon Red Hat:enterprise_linux:7::computenode | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-config-network Red Hat:enterprise_linux:7::computenode | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-config-nwfilter Red Hat:enterprise_linux:7::computenode | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-interface Red Hat:enterprise_linux:7::computenode | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-lxc Red Hat:enterprise_linux:7::computenode | All versions | 0:4.5.0-36.el7_9.3 |
libvirt-daemon-driver-network Red Hat:enterprise_linux:7::computenode | All versions | 0:4.5.0-36.el7_9.3 |
Products include Opensuse Leap, Redhat Libvirt.
How do I fix CVE-2020-25637?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2020-25637 being exploited?
There is no known exploitation of CVE-2020-25637 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Opensuse Leap
Sources
Also known as ALPINE-CVE-2020-25637, AZL-6658, DEBIAN-CVE-2020-25637, DLA-2395-1, GHSA-2qf3-2mv6-pggh, MGASA-2020-0473 and 2 more.