The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex. NOTE: some of these details are obtained from third party information.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-0218 advisory.

    [0.0.14-14.el6]
    - backport of upstream commit 30b4b72cdbdf9f0e92a8d1c4e01779f60f15a741       support _ASYNC io calls and interrupt handling (busy wait)       Related: #888364

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated x11-driver-video-qxl package fixes security vulnerability :

A flaw was found in the way the host's qemu-kvm qxl driver and the guest's X.Org qxl driver interacted when a SPICE connection terminated. A user able to initiate a SPICE connection to a guest could use this flaw to make the guest temporarily unavailable or, potentially (if the sysctl kernel.softlockup_panic variable was set to 1 in the guest), crash the guest (CVE-2013-0241).

It was discovered that the QXL graphics driver incorrectly handled terminated connections. An attacker that could connect to a guest using SPICE and the QXL graphics driver could cause the guest to hang or crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way the host's qemu-kvm qxl driver and the guest's X.Org qxl driver interacted when a SPICE connection terminated. A user able to initiate a SPICE connection to a guest could use this flaw to make the guest temporarily unavailable or, potentially (if the sysctl kernel.softlockup_panic variable was set to '1' in the guest), crash the guest. (CVE-2013-0241)

All running X.Org server instances using the qxl driver must be restarted for this update to take effect.

An updated xorg-x11-drv-qxl package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The xorg-x11-drv-qxl package provides an X11 video driver for the QEMU QXL video accelerator. This driver makes it possible to use Red Hat Enterprise Linux 6 as a guest operating system under the KVM kernel module and the QEMU multi-platform emulator, using the SPICE protocol.

A flaw was found in the way the host's qemu-kvm qxl driver and the guest's X.Org qxl driver interacted when a SPICE connection terminated. A user able to initiate a SPICE connection to a guest could use this flaw to make the guest temporarily unavailable or, potentially (if the sysctl kernel.softlockup_panic variable was set to '1' in the guest), crash the guest. (CVE-2013-0241)

All users of xorg-x11-drv-qxl are advised to upgrade to this updated package, which contains a backported patch to correct this issue. All running X.Org server instances using the qxl driver must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
68722	Oracle Linux 6 : xorg-x11-drv-qxl (ELSA-2013-0218)	Nessus	Oracle Linux Local Security Checks	high
66150	Mandriva Linux Security Advisory : x11-driver-video-qxl (MDVSA-2013:138)	Nessus	Mandriva Local Security Checks	low
64481	Ubuntu 11.10 / 12.04 LTS : xserver-xorg-video-qxl vulnerability (USN-1714-1)	Nessus	Ubuntu Local Security Checks	low
64429	Scientific Linux Security Update : xorg-x11-drv-qxl on SL6.x i386/x86_64 (20130131)	Nessus	Scientific Linux Local Security Checks	low
64392	RHEL 6 : xorg-x11-drv-qxl (RHSA-2013:0218)	Nessus	Red Hat Local Security Checks	low
64385	CentOS 6 : xorg-x11-drv-qxl (CESA-2013:0218)	Nessus	CentOS Local Security Checks	low

Detections

Analytics

CVE-2013-0241

medium

Tenable Plugins

high

low

low

low

low

low