CVE-2020-25650: debian debian_linux

Vulnerability summary

CVE-2020-25650 is a medium (CVSS 5.5) vulnerability in debian debian_linux. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-11-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.