CVE-2020-10701

    Dashboard / Vulnerabilities / CVE-2020-10701

    CVE-2020-10701

    Published: 27 May 2021Last Modified: 8 Jul 2026

    Summary:

    Details: A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0.

    References: https://security.netapp.com/advisory/ntap-20210708-0001/, https://bugzilla.redhat.com/show_bug.cgi?id=1819163

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -07bb8ff4dd0ca0224754c582390f4a873597c4b9

    Affected versions

    v6.2.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-10701 | CVE-DB