CVE-2019-20485: 
NixOS vulnerability analysis and mitigation

CVE-2019-20485 affects libvirt versions before 6.0.0, specifically in the qemu/qemu_driver.c component. The vulnerability was discovered and disclosed in March 2020, impacting the libvirt virtualization API library that provides virtualization capabilities for Linux and other operating systems (NVD, CVE).

The vulnerability stems from a mishandling of monitor jobs during queries to a guest agent in the qemu/qemu_driver.c component. The issue specifically occurs when the libvirtd daemon issues the 'suspend' command to a QEMU guest-agent running inside a guest while holding a monitor job (RedHat Bugzilla).

The vulnerability allows attackers to cause a denial of service condition by blocking the Libvirt daemon indefinitely. This results in API blockage, potentially affecting the management and operation of virtual machines (NVD, RedHat Bugzilla).

A malicious guest-agent can exploit this vulnerability to block the Libvirt daemon indefinitely, leading to a denial of service scenario. The attack vector requires the ability to control or manipulate the guest-agent's response to the suspend command (RedHat Bugzilla).

The vulnerability was fixed in libvirt version 6.0.0. Red Hat released security updates for affected versions through RHSA-2020:4000 for RHEL 7 and RHSA-2020:4676 for RHEL 8. Debian also addressed this issue in version 6.0.0-1 (Debian Bug, RedHat Errata).