CVE-2020-14339: 
NixOS vulnerability analysis and mitigation

A vulnerability (CVE-2020-14339) was discovered in libvirt version 6.2.0, where it accidentally leaked a file descriptor for /dev/mapper/control into the QEMU process. This vulnerability allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system (CVE Database, Red Hat Bugzilla).

The vulnerability was introduced in libvirt version 6.2.0 and involves the unintended exposure of a file descriptor that allows privileged operations to be made against the device mapper on the host. The file descriptor for /dev/mapper/control was insufficiently protected, giving unauthorized access to privileged operations (Gentoo Security, Red Hat Bugzilla).

The vulnerability enables a malicious QEMU guest to potentially cause serious damage to the host operating system by performing privileged operations against the device mapper. This poses significant risks to the confidentiality, integrity, and availability of the host system (CVE Database).

The vulnerability is locally exploitable and requires a malicious guest user or process to access the leaked file descriptor. The severity is rated as high due to the potential for root privilege escalation (Gentoo Security).

The issue is mitigated on Red Hat Enterprise Linux if SELinux is in enforcing mode, which prevents the /dev/mapper/control file descriptor from being accessible by a guest user/process. The vulnerability was fixed in libvirt version 6.7.0 and later. Users are advised to upgrade to the latest version of libvirt (Red Hat Bugzilla, Gentoo Security).