PT-2013-1175 · Red Hat+1 · Qxl Virtual Gpu+6

Published 2013-01-31 · Updated 2023-02-13 · CVE-2013-0241

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions QXL Virtual GPU version 0.1.0 xorg-x11-drv-qxl version 0.0.14 xorg-x11-drv-qxl-debuginfo version 0.0.14

Description The issue allows local users to cause a denial of service, potentially leading to a guest crash or hang, via a SPICE connection that prevents other threads from obtaining the qemu mutex mutex. This can be exploited locally, leading to a disruption in the availability of protected information.

Recommendations For QXL Virtual GPU version 0.1.0, consider disabling the SPICE connection as a temporary workaround to prevent exploitation. For xorg-x11-drv-qxl version 0.0.14 and xorg-x11-drv-qxl-debuginfo version 0.0.14, restrict local access to minimize the risk of exploitation until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-06681

BDU:2015-06682

BDU:2015-08949

BDU:2015-08950

CESA-2013_0218

CVE-2013-0241

RHSA-2013:0218

RHSA-2013_0218

Affected Products

Centos

Qxl Virtual Gpu

Red Hat

Spice

Qemu

Xorg-X11-Drv-Qxl

Xorg-X11-Drv-Qxl-Debuginfo

References · 27

• http://mandriva.com/security/advisories?name=MDVSA-2013:138 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06681 · Security Note
• https://bdu.fstec.ru/vul/2015-08950 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0241 · Security Note
• https://bdu.fstec.ru/vul/2015-08949 · Security Note
• https://osv.dev/vulnerability/CVE-2013-0241 · Vendor Advisory
• http://ubuntu.com/usn/USN-1714-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06682 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-0241 · Vendor Advisory
• http://secunia.com/advisories/52021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0241 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0218.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0241 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-0218.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2013-0218.html · Note