CVE-2020-25650
Medium
Description
A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Spice-space Spice-vdagent
PublishedNov 25, 2020
First seenNov 25, 2020
Weakness typeCWE-770Allocation of resources without limits
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| spice-space spice-vdagent | v ≤ 0.20.0 | — |
| debian debian_linux | 9.0 | — |
| fedoraproject fedora | 32, 33 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.