NULL pointer dereference in The Libvirt Project
CVE-2019-3840
A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.
EPSS: 0.015 (71.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H.
Affected products
- The Libvirt Project — versions 5.0.0
- Opensuse Leap — versions 15.0, 42.3
- Redhat Libvirt
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch, Issue Tracking, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Third Party Advisory, Issue Tracking, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- secalert@redhat.com (x_refsource_FEDORA, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2019-3840?
- CVE-2019-3840 is a medium-severity vulnerability in The Libvirt Project, classified under NULL Pointer Dereference. CVSS score: 5.8/10. Published 2019-03-27.
- How severe is CVE-2019-3840?
- Medium severity. CVSS v3 base score is 5.8 out of 10.