PT-2015-4011 · Qemu+1 · Libvirt+1

Martin Kletzander · Publicado 2014-12-18 · Atualizado 2024-06-15 · CVE-2014-8131

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 1.2.11

Description The issue arises from the qemu implementation of virConnectGetAllDomainStats in libvirt, which fails to handle locks correctly when a domain is skipped due to ACL restrictions. This allows remote authenticated users to cause a denial of service, resulting in a deadlock or segmentation fault and crash, by making a request to access domains they do not have privileges to access.

Recommendations For versions prior to 1.2.11, update to version 1.2.11 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2014-2472

CVE-2014-8131

OPENSUSE-SU-2024:10209-1

Produtos afetados

Alt Linux

Libvirt

Referências · 98

• https://bdu.fstec.ru/vul/2015-07129 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09272 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-3657 · Nota
• https://bdu.fstec.ru/vul/2015-09264 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09256 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-07119 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-5247 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8135 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09259 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-07137 · Nota de Segurança
• https://suse.com/security/cve/CVE-2013-4154 · Nota
• https://bdu.fstec.ru/vul/2015-09147 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-8131 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-07125 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-0028 · Nota