PT-2014-3374 · Red Hat · Libvirt

Marian Krcmarik · Publicado 2014-05-07 · Atualizado 2018-10-30 · CVE-2013-7336

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 1.1.3

Description The issue arises from the qemuMigrationWaitForSpice function in libvirt, which fails to properly enter a monitor during seamless SPICE migration. This allows local users to cause a denial of service by triggering a NULL pointer dereference and subsequent libvirtd crash. The crash occurs when the domblkstat function is called simultaneously with the qemuMonitorGetSpiceMigrationStatus function.

Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2013-7336

USN-2209-1

Produtos afetados

Libvirt

Referências · 18

• http://lists.opensuse.org/opensuse-updates/2014-05/msg00004.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1077620 · Nota
• https://osv.dev/vulnerability/CVE-2013-7336 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2209-1 · Aviso do Fabricante
• http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=484cc321 · Nota
• http://security.gentoo.org/glsa/glsa-201412-04.xml · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/03/18/1 · Nota
• http://security.libvirt.org/2013/0021.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-7336 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/03/18/3 · Correção
• http://redhat.com/archives/libvir-list/2013-September/msg01208.html · Nota
• https://cve.org/CVERecord?id=CVE-2013-7336 · Nota de Segurança
• https://ubuntu.com/security/CVE-2013-7336 · Aviso do Fabricante
• http://libvirt.org/news.html · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7336 · Aviso do Fabricante