Read the docs
TI-2019-14711 Aliases CVE-2019-20485GHSA-9283-64xm-984q

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during…

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).

Why it matters now

EPSS 0.00813 57th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 12 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*before 6.0.0VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
  • cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:* Versions before 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject

Remediation

Red Hat 2 advisories

  • RHSA-2020:4676 Released 2020-11-04 · Red Hat rating Moderate
    virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) SLOF-20191022-3.git899d9883.module+el8.3.0+6423+e4cb6418.src::virt-devel:rhel, hivex-1.3.18-20.module+el8.3.0+6423+e4cb6418.i686::virt-devel:rhel, hivex-devel-1.3.18-20.module+el8.3.0+6423+e4cb6418.i686::virt-devel:rhel +47
    • Red Hat Enterprise Linux AppStream (v. 8) SLOF-20191022-3.git899d9883.module+el8.3.0+6423+e4cb6418.noarch::virt:rhel, SLOF-20191022-3.git899d9883.module+el8.3.0+6423+e4cb6418.src::virt:rhel, hivex-1.3.18-20.module+el8.3.0+6423+e4cb6418.aarch64::virt:rhel +47
  • RHSA-2020:4000 Released 2020-09-29 · Red Hat rating Moderate
    libvirt security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) libvirt-4.5.0-36.el7, libvirt-bash-completion-4.5.0-36.el7, libvirt-client-4.5.0-36.el7 +21
    • Red Hat Enterprise Linux Client Optional (v. 7) libvirt-admin-4.5.0-36.el7, libvirt-daemon-lxc-4.5.0-36.el7, libvirt-devel-4.5.0-36.el7 +4
    • Red Hat Enterprise Linux ComputeNode (v. 7) libvirt-4.5.0-36.el7, libvirt-bash-completion-4.5.0-36.el7, libvirt-client-4.5.0-36.el7 +1
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libvirt-4.5.0-36.el7, libvirt-admin-4.5.0-36.el7, libvirt-daemon-4.5.0-36.el7 +25
    • Red Hat Enterprise Linux Server (v. 7) libvirt-4.5.0-36.el7, libvirt-bash-completion-4.5.0-36.el7, libvirt-client-4.5.0-36.el7 +26
    • Red Hat Enterprise Linux Server Optional (v. 7) libvirt-admin-4.5.0-36.el7, libvirt-daemon-lxc-4.5.0-36.el7, libvirt-lock-sanlock-4.5.0-36.el7 +3
    • Red Hat Enterprise Linux Workstation (v. 7) libvirt-4.5.0-36.el7, libvirt-bash-completion-4.5.0-36.el7, libvirt-client-4.5.0-36.el7 +22
    • Red Hat Enterprise Linux Workstation Optional (v. 7) libvirt-admin-4.5.0-36.el7, libvirt-daemon-lxc-4.5.0-36.el7, libvirt-docs-4.5.0-36.el7 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8 Advanced VirtualizationAffectedNo fix yet
Advanced Virtualization CodeReady Builder for RHEL 8.2.0Fixed—
Advanced Virtualization for RHEL 8.2.0Fixed—
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2020:4676
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4676
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:4000
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:4000
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:4000
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:4000
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:4000
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:4000
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:4000
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:4000

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-20485
  2. 2026-10-03 Alias added: GHSA-9283-64xm-984q

References

Advisory 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences