CVE-2013-7336

Severity

19%

Complexity

34%

Confidentiality

48%

The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.

CWE-476: NULL Pointer Dereference

CVSS 2.0 Base Score 1.9. CVSS Attack Vector: local. CVSS Attack Complexity: medium. CVSS Vector: (AV:L/AC:M/Au:N/C:N/I:N/A:P).

Overview

First reported 10 years ago

2014-05-07 10:55:00

Last updated 6 years ago

2018-10-30 16:27:00

Affected Software

Red Hat libvirt 1.0.0

1.0.0

Red Hat libvirt 1.0.1

1.0.1

Red Hat libvirt 1.0.2

1.0.2

Red Hat libvirt 1.0.3

1.0.3

Red Hat libvirt 1.0.4

1.0.4

Red Hat libvirt 1.0.5

1.0.5

Red Hat libvirt 1.0.5.1

1.0.5.1

Red Hat libvirt 1.0.5.2

1.0.5.2

Red Hat libvirt 1.0.5.3

1.0.5.3

Red Hat libvirt 1.0.5.4

1.0.5.4

Red Hat libvirt 1.0.5.5

1.0.5.5

Red Hat libvirt 1.0.5.6

1.0.5.6

Red Hat libvirt 1.0.6

1.0.6

Red Hat libvirt 1.1.0

1.1.0

Red Hat libvirt 1.1.1

1.1.1

Red Hat libvirt

OpenSUSE 13.1

13.1

References

http://libvirt.org/git/?p=libvirt.git;a=commit;h=484cc321

Patch

http://libvirt.org/news.html

openSUSE-SU-2014:0593

60895

GLSA-201412-04

[oss-security] 20140318 CVE request -- libvirt: unprivileged user can crash libvirtd during spice migration

[oss-security] 20140318 Re: CVE request -- libvirt: unprivileged user can crash libvirtd during spice migration