The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when…

Description

The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.

Scores

EPSS (exploitation in 30 days)

0.39% · top 66% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.1.

Weakness

• n/a
• CWE-264 (opens in a new tab)

Affected products

• n/a

  • affected n/a

References (9)

• http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=2bdcd29c713dfedd813c89f56ae98f6f3898313d (opens in a new tab)x_refsource_CONFIRMx_transferred
• MDVSA-2015:070 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• openSUSE-SU-2015:0006 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 61111 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• openSUSE-SU-2015:0008 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• http://advisories.mageia.org/MGASA-2015-0002.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2015:0323 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• MDVSA-2015:023 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• USN-2867-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 6 Aug 2024, 13:10 UTC.