Vulnerability CVE-2025-12748: Information
Description
A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.
Severity: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| libvirt | sisyphus | 11.10.0-alt1 | 11.10.0-alt1 | ALT-PU-2025-15269-2 | 401568 | Fixed |
| libvirt | sisyphus_riscv64 | 11.10.0-alt1 | 11.10.0-alt1 | ALT-PU-2025-15300-1 | - | Fixed |
| libvirt | sisyphus_loongarch64 | 11.10.0-alt1 | 11.10.0-alt1 | ALT-PU-2025-15626-1 | - | Fixed |
| libvirt | p10 | 11.10.0-alt0.c10f2.1 | 9.7.0-alt2.p10.3 | ALT-PU-2025-15732-1 | 401614 | Testing |
| libvirt | c10f2 | 11.10.0-alt0.c10f2.1 | 9.7.0-alt2.p10.3 | ALT-PU-2025-15306-1 | 401592 | Testing |
| libvirt | p11 | 11.10.0-alt1 | 11.10.0-alt1 | ALT-PU-2025-15273-3 | 401580 | Fixed |