CVE-2020-25637

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

• CWE-415
• CWE-415

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00072.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00073.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1881037Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
• https://security.gentoo.org/glsa/202210-06Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00072.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00073.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1881037Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
• https://security.gentoo.org/glsa/202210-06Third Party Advisory

Published

Oct 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25631A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8…6.1
• CVE-2020-25632A flaw was found in grub2 in versions prior to 2.06. The rmm…8.2
• CVE-2020-25633A flaw was found in RESTEasy client in all versions of RESTE…5.3
• CVE-2020-25634A flaw was found in Red Hat 3scale’s API docs URL, where it …5.4
• CVE-2020-25635A flaw was found in Ansible Base when using the aws_ssm conn…5.5
• CVE-2020-25636A flaw was found in Ansible Base when using the aws_ssm conn…7.1
• CVE-2020-25638A flaw was found in hibernate-core in versions prior to and …7.4
• CVE-2020-25639A NULL pointer dereference flaw was found in the Linux kerne…4.4
• CVE-2020-2564Vulnerability in the Siebel UI Framework product of Oracle S…5.3
• CVE-2020-25640A flaw was discovered in WildFly before 21.0.0.Final where, …5.3
• CVE-2020-25641A flaw was found in the Linux kernel's implementation of bio…5.5
• CVE-2020-25643A flaw was found in the HDLC_PPP module of the Linux kernel …7.2