CVE-2020-14339

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-14339
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-14339.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-14339
Related
Published
2020-12-03T17:15:12Z
Modified
2024-10-12T06:05:19.813935Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in libvirt, where it leaked a file descriptor for /dev/mapper/control into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

References

Affected packages

Alpine:v3.12 / libvirt

Package

Name
libvirt
Purl
pkg:apk/alpine/libvirt?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.0-r0

Affected versions

0.*

0.8.4-r0
0.8.4-r1
0.8.5-r0
0.8.6-r0
0.8.6-r1
0.8.6-r2
0.8.7-r0
0.8.8-r0
0.9.0-r0
0.9.1-r0
0.9.1-r1
0.9.1-r2
0.9.2-r0
0.9.2-r1
0.9.2-r2
0.9.2-r3
0.9.3-r0
0.9.3-r1
0.9.4-r0
0.9.4-r1
0.9.6-r0
0.9.6-r1
0.9.9-r0
0.9.10-r0
0.9.10-r1
0.9.10-r2
0.9.10-r3
0.9.11-r0
0.9.12-r0
0.9.12-r1
0.9.12-r2
0.9.12-r3
0.9.13-r0
0.10.0-r0
0.10.1-r0
0.10.1-r1
0.10.2-r0
0.10.2-r1
0.10.2-r2
0.10.2-r3
0.10.2-r4
0.10.2-r5

1.*

1.0.2-r0
1.0.2-r1
1.0.3-r0
1.0.4-r0
1.0.5-r0
1.0.5-r1
1.0.6-r0
1.0.6-r1
1.0.6-r2
1.1.0-r0
1.1.0-r1
1.1.0-r2
1.1.1-r0
1.1.1-r1
1.1.2-r0
1.1.2-r1
1.1.3-r0
1.1.4-r0
1.2.0-r0
1.2.0-r1
1.2.0-r2
1.2.0-r3
1.2.0-r4
1.2.1-r0
1.2.2-r0
1.2.3-r0
1.2.3-r1
1.2.3-r2
1.2.3-r3
1.2.4-r0
1.2.5-r0
1.2.6-r0
1.2.6-r1
1.2.7-r0
1.2.7-r1
1.2.8-r0
1.2.9-r0
1.2.9-r1
1.2.10-r0
1.2.10-r1
1.2.11-r0
1.2.12-r0
1.2.13-r0
1.2.13-r1
1.2.14-r0
1.2.14-r1
1.2.14-r2
1.2.15-r0
1.2.15-r1
1.2.16-r0
1.2.17-r0
1.2.17-r1
1.2.17-r2
1.2.18-r0
1.2.18-r1
1.2.19-r0
1.2.20-r0
1.2.20-r1
1.2.21-r0
1.2.21-r1
1.2.21-r2
1.3.1-r0
1.3.2-r0
1.3.3-r0
1.3.3-r1
1.3.3-r2
1.3.5-r0
1.3.5-r1
1.3.5-r2

2.*

2.0.0-r0
2.1.0-r0
2.2.0-r0
2.3.0-r0
2.3.0-r1
2.5.0-r1

3.*

3.0.0-r0
3.1.0-r0
3.2.0-r0
3.2.0-r1
3.2.0-r2
3.3.0-r0
3.3.0-r1
3.4.0-r0
3.4.0-r1
3.5.0-r0
3.6.0-r0
3.7.0-r0
3.8.0-r0
3.9.0-r0
3.9.0-r1
3.10.0-r0

4.*

4.0.0-r0
4.1.0-r0
4.2.0-r0
4.3.0-r0
4.4.0-r0
4.5.0-r0
4.6.0-r0
4.6.0-r1
4.10.0-r0
4.10.0-r1

5.*

5.0.0-r0
5.0.0-r1
5.1.0-r0
5.2.0-r0
5.3.0-r0
5.3.0-r1
5.3.0-r2
5.4.0-r0
5.5.0-r0
5.6.0-r0
5.7.0-r0
5.8.0-r0
5.9.0-r0
5.10.0-r0
5.10.0-r1

6.*

6.0.0-r0
6.0.0-r1
6.1.0-r0
6.2.0-r0
6.2.0-r1
6.3.0-r0
6.5.0-r0

Debian:11 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/libvirt/libvirt

Affected ranges

Type
GIT
Repo
https://github.com/libvirt/libvirt
Events
Introduced
07bb8ff4dd0ca0224754c582390f4a873597c4b9
Fixed
88f45e72688cec14eb58bbdb120336bbaa36a1fc

Affected versions

v6.*

v6.2.0
v6.3.0
v6.3.0-rc1
v6.4.0
v6.4.0-rc1
v6.5.0
v6.5.0-rc1
v6.5.0-rc2
v6.6.0
v6.6.0-rc1
v6.7.0-rc1
v6.7.0-rc2