← Vulnerability feed

Vulnerability record · CVE-2020-10703 · published 2 June 2020

CVE-2020-10703: Redhat libvirt null pointer dereference vulnerability

Redhat · Libvirt

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.

6.5 CVSS 3.1 Medium EPSS 2.4% · top 16.9% CWE-476 · NULL pointer dereference
6.5CVSS 3.1 base score, v2 4.0
2.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugzilla.redhat.com/show_bug.cgi?id=1790725 ExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10703 Issue TrackingPatchVendor Advisory
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=5d5c732d748d644ec14626bce448e84bdc4bd93e
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=dfff16a7c261f8d28e3abe60a47165f845fa952f
https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMK
https://security.netapp.com/advisory/ntap-20200608-0005/
https://bugzilla.redhat.com/show_bug.cgi?id=1790725 ExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10703 Issue TrackingPatchVendor Advisory
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=5d5c732d748d644ec14626bce448e84bdc4bd93e
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=dfff16a7c261f8d28e3abe60a47165f845fa952f
https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMK
https://security.netapp.com/advisory/ntap-20200608-0005/

Track CVE-2020-10703 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-5008Redhat libvirt improper access control vulnerabilitylibvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers…EPSS 3.6%8.8CVE-2020-14339Redhat libvirt vulnerabilityA flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privi…EPSS 0.42%8.8CVE-2019-10132Redhat libvirt incorrect permission assignment vulnerabilityA vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configurati…EPSS 1.4%8.5CVE-2013-4401Redhat libvirt permissions and access controls vulnerabilityThe virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permi…EPSS 1.7%8.1CVE-2017-1000256Redhat libvirt improper certificate validation vulnerabilitylibvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to …EPSS 1.7%7.8CVE-2019-10166Redhat libvirt improper access control vulnerabilityIt was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDe…EPSS 0.47%7.8CVE-2019-10167Redhat libvirt execution with unnecessary privileges vulnerabilityThe virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify …EPSS 0.52%7.8CVE-2019-10168Redhat libvirt execution with unnecessary privileges vulnerabilityThe virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emula…EPSS 0.55%

Source: NIST National Vulnerability Database (record CVE-2020-10703), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.