CVE-2011-1146
redhat libvirt: no CVSS score yet. EPSS 1.6% chance of exploitation in the next 30 days.
libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:libvirt
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617773
- http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=71753cb7f7a16ff800381c0b5ee4e99eea92fed3
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056209.html
- http://lists.opensuse.org/opensuse-updates/2011-04/msg00022.html
- http://openwall.com/lists/oss-security/2011/03/09/3