CVE-2020-25652
Medium
Description
A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Spice-space Spice-vdagent
PublishedNov 26, 2020
First seenNov 26, 2020
Weakness typeCWE-770Allocation of resources without limits
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| spice-space spice-vdagent | v ≤ 0.20.0 | — |
| debian debian_linux | 9.0 | — |
| fedoraproject fedora | 32, 33 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.