CVE-2011-1146: Red Hat Libvirt

Medium severity, CVSS 6.9. EPSS: 1.5% chance of exploitation in the next 30 days.

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.

Affected products

• Red Hat Libvirt: version 0.8.8 only

Published 2011-03-15. Last modified 2026-06-16.