LiveActive security incident?Get immediate response
CVE Record

CVE-2020-25653: A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections.

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw affects the SPICE guest agent used in some virtualized Linux environments. A local, unprivileged user inside a guest could race to become the active agent connection, potentially disrupting service or exposing host-related information. It is not a broad internet-facing issue, but it matters for shared desktops, multi-user VMs, and managed virtual workstation fleets.

Executive priority

Prioritize remediation for shared or multi-user virtual desktops and environments where guest users are not fully trusted. For single-user trusted VMs, urgency is lower, but patching should still follow normal security maintenance because confidentiality and availability impacts are documented.

Technical view

CVE-2020-25653 is a CWE-362 race condition in spice-vdagentd handling new client connections. Sources state an unprivileged local guest user may become the active agent for spice-vdagentd, with possible denial of service or host information leakage. The affected upstream scope is spice-vdagent versions 0.20 and prior.

Likely exposure

Exposure is most likely in Linux virtual machines or virtual desktop images using SPICE integration and spice-vdagent 0.20 or earlier. Systems without SPICE guest agent functionality are not indicated as affected by the provided sources.

Exploitation context

The provided bundle does not show CISA KEV listing or active exploitation. The attacker position described is local and unprivileged inside the guest, not remote internet access. Exploitation depends on winning a race in agent connection handling.

Researcher notes

The source bundle lacks CVSS metrics and detailed patch mechanics, so validation should stay package- and vendor-advisory driven. The key trust boundary is between a local guest user and spice-vdagentd’s active agent state, with impact described as host information leakage or denial of service.

Mitigation direction

  • Apply vendor or distribution security updates for spice-vdagent.
  • Upgrade affected spice-vdagent deployments beyond versions 0.20 and prior.
  • Disable or remove spice-vdagent where SPICE integration is not required.
  • Limit untrusted local user access to affected guest systems.
  • Track Red Hat, Debian, and Fedora advisories for package-specific guidance.

Validation and detection

  • Inventory VM images and guests for installed spice-vdagent packages.
  • Confirm whether installed versions are 0.20 or prior.
  • Verify distribution security updates have been applied successfully.
  • Identify systems using SPICE guest agent features.
  • Review virtualization fleet standards for unnecessary SPICE agent enablement.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-362: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-25653 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aspice-vdagentspice-vdagent versions 0.20 and priorListed
Weakness

CWE details

CWE-362

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.