The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the status of LXC guests when reading memory tunables, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) via a guest in the shutdown status, as demonstrated by the "virsh memtune" command.

The remote host is affected by the vulnerability described in GLSA-201412-04 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service or cause       information leakage. A local attacker may be able to escalate privileges,       cause a Denial of Service or possibly execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

- CVE-2013-6436: Fix crashes in lxc memtune code, one of     which results in DoS f8c1cb90-CVE-2013-6436.patch,     9faf3f29-LXC-memtune.patch bnc#854486

  - Backported upstream patch to fix LXC container failing     start. bnc#855239

  - Building with polkit support requires polkit-devel     bnc#854144

Martin Kletzander discovered that libvirt incorrectly handled reading memory tunables from LXC guests. A local user could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service.
This issue only affected Ubuntu 13.10. (CVE-2013-6436)

Dario Faggioli discovered that libvirt incorrectly handled the libxl driver. A local user could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 13.10. (CVE-2013-6457)

It was discovered that libvirt contained multiple race conditions in block device handling. A remote read-only user could use this flaw to cause libvirtd to crash, resulting in a denial of service.
(CVE-2013-6458)

Eric Blake discovered that libvirt incorrectly handled certain ACLs.
An attacker could use this flaw to possibly obtain certain sensitive information. This issue only affected Ubuntu 13.10. (CVE-2014-0028)

Jiri Denemark discovered that libvirt incorrectly handled keepalives.
A remote attacker could possibly use this flaw to cause libvirtd to crash, resulting in a denial of service. (CVE-2014-1447).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a crash in LXC's memtune code. CVE-2013-6436 has been assigned to this issue.

ID	Name	Product	Family	Severity
79814	GLSA-201412-04 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75411	openSUSE Security Update : libvirt (openSUSE-SU-2014:0010-1)	Nessus	SuSE Local Security Checks	low
72232	Ubuntu 12.04 LTS / 12.10 / 13.10 : libvirt vulnerabilities (USN-2093-1)	Nessus	Ubuntu Local Security Checks	medium
72229	SuSE 11.3 Security Update : libvirt (SAT Patch Number 8705)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2013-6436

medium

Tenable Plugins

high

low

medium

low