CVE-2020-25637

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 6.8.0

Description A double free memory issue was found in the libvirt API, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver, allowing clients with limited ACL permissions to potentially crash the libvirt daemon or escalate their privileges. The highest threat from this issue is to data confidentiality and integrity as well as system availability.

Recommendations For versions prior to 6.8.0, update to version 6.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the read-write socket to minimize the risk of exploitation. Additionally, limiting ACL permissions for clients connecting to the libvirt daemon can help mitigate the risk until a patch is applied.