CVE catalog

CVE-2020-12430

libvirt: CVE-2020-12430

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Feb 19, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.27% · Oct 25, 2026

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libvirt	sid	`12.8.0-1`	fixed
Debian	libvirt	forky	`12.8.0-1`	fixed
Debian	libvirt	trixie	`11.3.0-3+deb13u3`	fixed
Debian	libvirt	bookworm	`9.0.0-4+deb12u2`	fixed
Alpine	libvirt	3.10	`5.5.0-r1`	fixed
Alpine	libvirt	3.11	`5.9.0-r1`	fixed
Alpine	libvirt	3.8	`5.5.0-r1`	fixed
Alpine	libvirt	3.9	`5.5.0-r1`	fixed
Ubuntu	libvirt	20.04	`5.4.0-0ubuntu5`	vulnerable
Ubuntu	libvirt	20.04	`6.0.0-0ubuntu1`	vulnerable
Ubuntu	libvirt	20.04	`6.0.0-0ubuntu2`	vulnerable
Ubuntu	libvirt	20.04	`6.0.0-0ubuntu3`	vulnerable
Ubuntu	libvirt	20.04	`6.0.0-0ubuntu4`	vulnerable
Ubuntu	libvirt	20.04	`6.0.0-0ubuntu5`	vulnerable
Ubuntu	libvirt	20.04	`6.0.0-0ubuntu6`	fixed
Opensuse	libvirt	tumbleweed	`10.9.0-3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libvirt	source	sid	`6.4.0-2`	low	Not reported	[959447]
Debian	libvirt	source	forky	`6.4.0-2`	low	Not reported	[959447]
Debian	libvirt	source	trixie	`6.4.0-2`	low	Not reported	[959447]
Debian	libvirt	source	bookworm	`6.4.0-2`	low	Not reported	[959447]
Alpine	libvirt	apk	3.10	`5.5.0-r1`	Not reported	ALPINE-CVE-2020-12430	Not reported
Alpine	libvirt	apk	3.11	`5.9.0-r1`	Not reported	ALPINE-CVE-2020-12430	Not reported
Alpine	libvirt	apk	3.8	`5.5.0-r1`	Not reported	ALPINE-CVE-2020-12430	Not reported
Alpine	libvirt	apk	3.9	`5.5.0-r1`	Not reported	ALPINE-CVE-2020-12430	Not reported
Ubuntu	libvirt	deb	20.04	`6.0.0-0ubuntu6`	Not reported	UBUNTU-CVE-2020-12430	Not reported
Opensuse	libvirt	rpm	tumbleweed	`10.9.0-3.1`	Not reported	OPENSUSE-SU-2024:14490-1	Not reported

[Debian bug #959447]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libvirt-client]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-client-qemu]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-common]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-config-network]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-config-nwfilter]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-libxl]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-lxc]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-network]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-nodedev]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-nwfilter]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-qemu]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-secret]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-storage]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-storage-core]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-storage-disk]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-storage-iscsi]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-storage-iscsi-direct]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-storage-logical]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed
[libvirt-daemon-driver-storage-mpath]Unknown
Source package: [libvirt]
Details (1)
- 12.6.0-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 10.9.0-3.1
  Version impact unknown
  dsa · libvirt · opensuse · tumbleweed

Next results

Observed: Oct 23, 2026, 5:47:19 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]