CVE-2020-12430: 
NixOS vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2020-12430) was discovered in libvirt versions 4.10.0 through 6.x before 6.1.0. The issue was found in the virDomainListGetStats libvirt API, specifically in the qemuDomainGetStatsIOThread function in qemu/qemu_driver.c, which is responsible for retrieving domain statistics when managing QEMU guests (CVE Details, NVD).

The vulnerability exists in the qemuDomainGetStatsIOThread() function, which was introduced in libvirt version 4.10.0. The function returns a NULL-terminated list even when no iothreads are present, but neither the function nor its caller performed proper cleanup, resulting in a memory leak. The issue occurs because the list was returned without being properly free'd when no iothreads were present (Red Hat Bugzilla). The vulnerability has a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

The vulnerability allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, which can result in a denial of service condition. The impact is primarily on system availability, with no direct effect on confidentiality or integrity (Ubuntu Security).

The vulnerability can be exploited by unprivileged users who have read-only connection access to the system. The attack requires network access with low attack complexity and low privileges, but no user interaction (NetApp Advisory).

The vulnerability was fixed in libvirt version 6.1.0. The patch adds a goto cleanup statement in case there are no iothreads, ensuring the NULL-terminated list is properly free'd. Various Linux distributions have released security updates to address this vulnerability, including Ubuntu 19.10 (version 5.4.0-0ubuntu5.4) and Fedora 31 (version 5.6.0-7.fc31) (Ubuntu USN, Fedora Update).