CVE-2020-10703: 
NixOS vulnerability analysis and mitigation

CVE-2020-10703 is a vulnerability discovered in the libvirt API that affects versions from 3.10.0 to versions prior to 6.0.0. The vulnerability involves a NULL pointer dereference in the API responsible for fetching a storage pool based on its target path. This flaw specifically affects storage pools created without a target path, such as network-based pools like gluster and RBD (CVE Details, Red Hat Bugzilla).

The vulnerability was introduced in libvirt upstream version v3.10.0 through the storagePoolLookupByTargetPathCallback function and became exposed as a public API in version 4.1.0 via the virStoragePoolLookupByTargetPath method. The issue occurs when an unprivileged user with a read-only connection calls the virStoragePoolLookupByTargetPath API with an empty path, which triggers a NULL pointer dereference in the callback function through virStoragePoolObjListSearch (Red Hat Bugzilla).

When successfully exploited, this vulnerability allows unprivileged users with a read-only connection to crash the libvirt daemon, resulting in a potential denial of service (DoS). The vulnerability has been rated with a CVSS score of 6.5 (MEDIUM) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NetApp Security).

To exploit this vulnerability, a storage pool without a target path must already exist on the system. An unprivileged user with read-only access can then trigger the flaw by calling the virStoragePoolLookupByTargetPath API with an empty path (''), leading to a segmentation fault in the libvirt daemon (Red Hat Bugzilla).

The vulnerability was fixed in libvirt version 6.0.0 through commit dfff16a7c261f8d28e3abe60a47165f845fa952f. Various distributions have released security updates to address this issue, including Red Hat Enterprise Linux via RHSA-2020:4000 and Debian via DLA-3778-1 (Debian Security, Fedora Updates).