CVE-2020-25637: 
NixOS vulnerability analysis and mitigation

A double free memory vulnerability (CVE-2020-25637) was discovered in the libvirt API before version 6.8.0. The vulnerability affects the polkit access control driver and specifically occurs in the qemuAgentGetInterfaces() function in qemu_agent.c when requesting information about network interfaces of a running QEMU domain (NVD, Red Hat).

The vulnerability exists in the qemuAgentGetInterfaces() function where it interacts with the guest agent and receives JSON data containing network interface information. The function enumerates interfaces one by one, using a pointer to pointers to hold a split interface name (ifname). During each iteration, ifname is freed, but if an error occurs immediately after, a 'goto error' statement triggers the error handler to free ifname again, resulting in a double free condition. The flaw was introduced in libvirt v1.2.14 and persisted even after an update in version 6.7.0 that replaced virStringListFree with g_strfreev() (Red Hat).

Clients connecting to the read-write socket with limited ACL permissions could exploit this vulnerability to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability affects data confidentiality, integrity, and system availability (NVD, Red Hat).

The vulnerability is limited by the check in virDomainInterfaceAddresses() in libvirt-domain.c, which prevents read-only clients from exploiting this flaw. However, clients with read-write socket access and limited ACL permissions can still trigger the vulnerability (Red Hat).

The vulnerability was fixed in libvirt version 6.8.0. Users are advised to upgrade to this version or later. Multiple distributions have released security updates to address this vulnerability, including Red Hat Enterprise Linux, Ubuntu, OpenSUSE, and Debian (Red Hat, Ubuntu).