#VU32583 Race condition in libvirt - CVE-2013-6458

Vulnerability identifier: #VU32583

Vulnerability risk: Medium

CVSSv4.0: 5.2 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2013-6458

CWE-ID: CWE-362

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
libvirt
Universal components / Libraries / Libraries used by multiple products

Vendor: libvirt.org

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.

Mitigation
Install update from vendor's website.

Vulnerable software versions

libvirt: 1.2.0

---

External links
https://libvirt.org/news.html
https://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html
https://lists.opensuse.org/opensuse-updates/2014-02/msg00062.html
https://rhn.redhat.com/errata/RHSA-2014-0103.html
https://secunia.com/advisories/56186
https://secunia.com/advisories/56446
https://secunia.com/advisories/60895
https://security.gentoo.org/glsa/glsa-201412-04.xml
https://www.debian.org/security/2014/dsa-2846
https://www.ubuntu.com/usn/USN-2093-1
https://bugzilla.redhat.com/show_bug.cgi?id=1043069

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.