The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.

The remote host is affected by the vulnerability described in GLSA-201412-04 (libvirt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service or cause       information leakage. A local attacker may be able to escalate privileges,       cause a Denial of Service or possibly execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

libvirt was updated to fix various bugs and security issues :

CVE-2013-7336: libvirt: unprivileged user can crash libvirtd during spice migration

CVE-2013-6456: unsafe usage of paths under /proc/$PID/root

Bugfixes for libvirt client killed on reboot shutdown. (bnc#852005)

Also notify systemd when we are ready to accept connections.

It was discovered that libvirt incorrectly handled symlinks when using the LXC driver. An attacker could possibly use this issue to delete host devices, create arbitrary nodes, and shutdown or power off the host. (CVE-2013-6456)

Marian Krcmarik discovered that libvirt incorrectly handled seamless SPICE migrations. An attacker could possibly use this issue to cause a denial of service. (CVE-2013-7336).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79814	GLSA-201412-04 : libvirt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75338	openSUSE Security Update : libvirt (openSUSE-SU-2014:0593-1)	Nessus	SuSE Local Security Checks	medium
73940	Ubuntu 13.10 : libvirt vulnerabilities (USN-2209-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-7336

critical

Tenable Plugins

high

medium

medium