A flaw was found in libvirtd. A null pointer in virJSONValueObjectHasKey function in util/virjson.c triggers a crash, resulting in remote denial of service via guest agent. References: https://bugzilla.redhat.com/show_bug.cgi?id=1663051 Upstream patch: https://www.redhat.com/archives/libvir-list/2019-January/msg00241.html
Created libvirt tracking bugs for this issue: Affects: fedora-all [bug 1665229] Created mingw-libvirt tracking bugs for this issue: Affects: fedora-all [bug 1665230]
The NULL pointer dereference is caused by the execution of qemuAgentGetInterfaces() in qemu/qemu_agent.c. A "guest-network-get-interfaces" command is sent to the guest agent through the qemuAgentCommand() function and although a reply is expected, the `needReply` parameter of qemuAgentCommand() is not set. Thus if for some reasons the qemu agent does not reply, the reply variable may be NULL, thus causing an error in virJSONValueObjectGet(), which is called immediately after the qemuAgentCommand() function.
An attacker who has an account on a Guest VM could use this flaw to crash libvirtd on the host, thus causing a Denial of Service for other VMs as well. An attacker would need high privileges to control qemu-ga and make it fail to reply to the "guest-network-get-interfaces" command sent by libvirtd, however we do not exclude other ways to prevent the guest agent from correctly replying.
For the flaw to be exploited, User Interaction is required as a user on the host needs to request a "guest-network-get-interfaces" agent command.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2294 https://access.redhat.com/errata/RHSA-2019:2294
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-3840