Race condition in libvirt

1) Race condition

EUVDB-ID: #VU32583

Risk: Medium

CVSSv4.0: 5.2 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6458

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libvirt: 1.2.0

CPE2.3

• cpe:2.3:a:libvirt_org:libvirt:1.2.0:*:*:*:*:*:*:*

External links

https://libvirt.org/news.html
https://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html
https://lists.opensuse.org/opensuse-updates/2014-02/msg00062.html
https://rhn.redhat.com/errata/RHSA-2014-0103.html
https://secunia.com/advisories/56186
https://secunia.com/advisories/56446
https://secunia.com/advisories/60895
https://security.gentoo.org/glsa/glsa-201412-04.xml
https://www.debian.org/security/2014/dsa-2846
https://www.ubuntu.com/usn/USN-2093-1
https://bugzilla.redhat.com/show_bug.cgi?id=1043069

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.