CVE-2020-25653
Summary
| CVE | CVE-2020-25653 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-11-26 02:15:00 UTC |
|---|
| Updated | 2023-11-07 03:20:00 UTC |
|---|
| Description | A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 32 Update: spice-vdagent-0.21.0-1.fc32 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 33 Update: spice-vdagent-0.21.0-1.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| oss-security - Security Issues in the spice-vdagentd daemon |
MISC |
www.openwall.com |
Exploit, Mailing List, Third Party Advisory |
| [SECURITY] Fedora 33 Update: spice-vdagent-0.21.0-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| [SECURITY] Fedora 32 Update: spice-vdagent-0.21.0-1.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
Mailing List, Third Party Advisory |
| 1886372 – (CVE-2020-25653) CVE-2020-25653 spice-vdagent: UNIX domain socket peer PID retrieved via `SO_PEERCRED` is subject to race condition |
MISC |
bugzilla.redhat.com |
Issue Tracking, Patch, Third Party Advisory |
| [SECURITY] [DLA 2524-1] spice-vdagent security update |
MLIST |
lists.debian.org |
Mailing List, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159216 Oracle Enterprise Linux Security Update for spice-vdagent (ELSA-2021-1791)
- 239302 Red Hat Update for spice-vdagent (RHSA-2021:1791)
- 377381 Alibaba Cloud Linux Security Update for spice-vdagent (ALINUX3-SA-2022:0084)
- 670499 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2257)
- 670525 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2283)
- 670557 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2316)
- 670592 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2350)
- 670694 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2452)
- 670962 EulerOS Security Update for spice-vdagent (EulerOS-SA-2021-2617)
- 750925 OpenSUSE Security Update for spice-vdagent (openSUSE-SU-2021:2614-1)
- 750974 SUSE Enterprise Linux Security Update for spice-vdagent (SUSE-SU-2021:2766-1)
- 750989 SUSE Enterprise Linux Security Update for spice-vdagent (SUSE-SU-2021:2803-1)
- 901471 Common Base Linux Mariner (CBL-Mariner) Security Update for spice-vdagent (7365-1)
- 940204 AlmaLinux Security Update for spice-vdagent (ALSA-2021:1791)
- 960751 Rocky Linux Security Update for spice-vdagent (RLSA-2021:1791)
