CVE-2019-3840

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.

• CWE-476
• CWE-476

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00101.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00105.htmlMailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2294
• https://bugzilla.redhat.com/show_bug.cgi?id=1663051Exploit, Issue Tracking, Third Party Advisory, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3840Exploit, Issue Tracking, Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZRP2BRMI4RYFRPNFTTIAAUOGVN2ORP7/
• https://www.redhat.com/archives/libvir-list/2019-January/msg00241.htmlExploit, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00101.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00105.htmlMailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2294
• https://bugzilla.redhat.com/show_bug.cgi?id=1663051Exploit, Issue Tracking, Third Party Advisory, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3840Exploit, Issue Tracking, Patch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZRP2BRMI4RYFRPNFTTIAAUOGVN2ORP7/
• https://www.redhat.com/archives/libvir-list/2019-January/msg00241.htmlExploit, Vendor Advisory

Published

Mar 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3834It was found that the fix for CVE-2014-0114 had been reverte…7.3
• CVE-2019-3835It was found that the superexec operator was available in th…5.5
• CVE-2019-3836It was discovered in gnutls before version 3.6.7 upstream th…5.9
• CVE-2019-3837It was found that the net_dma code in tcp_recvmsg() in the 2…6.1
• CVE-2019-3838It was found that the forceput operator could be extracted f…5.5
• CVE-2019-3839It was found that in ghostscript some privileged operators r…7.8
• CVE-2019-3841Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusiv…7.4
• CVE-2019-3842In systemd before v242-rc4, it was discovered that pam_syste…7
• CVE-2019-3843It was discovered that a systemd service that uses DynamicUs…7.8
• CVE-2019-3844It was discovered that a systemd service that uses DynamicUs…7.8
• CVE-2019-3845A lack of access control was found in the message queues mai…8
• CVE-2019-3846A flaw that allowed an attacker to corrupt memory and possib…8.8