PT-2014-3125 · Red Hat+2 · Libvirt+2

Eric Blake + 1 · Published 2014-03-05 · Updated 2024-06-15 · CVE-2013-6456

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:A/AC:M/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions libvirt versions 1.0.1 through 1.2.1

Description The issue allows local users to delete arbitrary host devices via the "virDomainDeviceDettach" API and a symlink attack on "/dev" in the container. It also enables users to create arbitrary nodes via the "virDomainDeviceAttach" API and a symlink attack on "/dev" in the container. Furthermore, it can cause a denial of service, such as shutting down or rebooting the host OS, via the "virDomainShutdown" or "virDomainReboot" API and a symlink attack on "/dev/initctl" in the container. This is related to paths under "/proc/$PID/root" and the virInitctlSetRunLevel function.

Recommendations For libvirt versions 1.0.1 through 1.2.1, consider disabling the virDomainDeviceDettach and virDomainDeviceAttach APIs as a temporary workaround to prevent arbitrary device deletion and node creation. Additionally, restrict access to the virDomainShutdown and virDomainReboot APIs to minimize the risk of denial of service attacks. Avoid using the virInitctlSetRunLevel function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2014-1262

CVE-2013-6456

MGASA-2014-0243

OPENSUSE-SU-2024:10209-1

SUSE-SU-2014_0785-1

USN-2209-1

Affected Products

Alt Linux

Suse

Libvirt

References · 80

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6436 · Security Note
• https://bdu.fstec.ru/vul/2015-09111 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1447 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6456 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0179 · Security Note
• http://security.libvirt.org/2013/0018.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6456 · Security Note
• https://osv.dev/vulnerability/CVE-2013-6456 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129199.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-6456 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-05/msg00004.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-6456 · Security Note
• https://ubuntu.com/security/CVE-2013-6456 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2209-1 · Vendor Advisory