PT-2014-3374 · Red Hat · Libvirt

Marian Krcmarik · Published 2014-05-07 · Updated 2018-10-30 · CVE-2013-7336

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 1.1.3

Description The issue arises from the qemuMigrationWaitForSpice function in libvirt, which fails to properly enter a monitor during seamless SPICE migration. This allows local users to cause a denial of service by triggering a NULL pointer dereference and subsequent libvirtd crash. The crash occurs when the domblkstat function is called simultaneously with the qemuMonitorGetSpiceMigrationStatus function.

Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue.

Fix

Related Identifiers

CVE-2013-7336

USN-2209-1

Affected Products

Libvirt

References · 18

• http://lists.opensuse.org/opensuse-updates/2014-05/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-7336 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2209-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201412-04.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-7336 · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/03/18/3 · Patch
• https://cve.org/CVERecord?id=CVE-2013-7336 · Security Note
• https://ubuntu.com/security/CVE-2013-7336 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7336 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7336 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1077620 · Note
• http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=484cc321 · Note
• http://openwall.com/lists/oss-security/2014/03/18/1 · Note
• http://security.libvirt.org/2013/0021.html · Note