CVE-2020-25652

Name of the Vulnerable Software and Affected Versions spice-vdagent versions 0.20 and prior

Description A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in /run/spice-vdagentd/spice-vdagent-sock. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Recommendations For spice-vdagent versions 0.20 and prior, update to a version later than 0.20 to resolve the issue. As a temporary workaround, consider restricting access to the UNIX domain socket in /run/spice-vdagentd/spice-vdagent-sock to prevent unprivileged local guest users from exploiting the flaw.