Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://libvirt.org/news.html - | |
| References | () http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html - | |
| References | () http://lists.opensuse.org/opensuse-updates/2014-02/msg00062.html - | |
| References | () http://rhn.redhat.com/errata/RHSA-2014-0103.html - | |
| References | () http://secunia.com/advisories/56186 - Vendor Advisory | |
| References | () http://secunia.com/advisories/56446 - Vendor Advisory | |
| References | () http://secunia.com/advisories/60895 - | |
| References | () http://security.gentoo.org/glsa/glsa-201412-04.xml - | |
| References | () http://www.debian.org/security/2014/dsa-2846 - | |
| References | () http://www.ubuntu.com/usn/USN-2093-1 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=1043069 - Vendor Advisory |
Information
Published : 2014-01-24 18:55
Updated : 2024-11-21 01:59
NVD link : CVE-2013-6458
Mitre link : CVE-2013-6458
CVE.ORG link : CVE-2013-6458
JSON object : View
Products Affected
redhat
- libvirt
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')