CVE-2014-3657

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fc22b2e74890873848b43fffae43025d22053669
http://lists.opensuse.org/opensuse-updates/2014-10/msg00014.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00017.html
http://rhn.redhat.com/errata/RHSA-2014-1352.html
http://secunia.com/advisories/60291
http://secunia.com/advisories/62303
http://security.libvirt.org/2014/0005.html	Vendor Advisory
http://www.ubuntu.com/usn/USN-2404-1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:libvirt:libvirt::::::::
	cpe:2.3:a:libvirt:libvirt:1.2.0:::::::*
	cpe:2.3:a:libvirt:libvirt:1.2.1:::::::*
	cpe:2.3:a:libvirt:libvirt:1.2.2:::::::*
	cpe:2.3:a:libvirt:libvirt:1.2.3:::::::*
	cpe:2.3:a:libvirt:libvirt:1.2.4:::::::*
	cpe:2.3:a:libvirt:libvirt:1.2.5:::::::*
	cpe:2.3:a:libvirt:libvirt:1.2.6:::::::*
	cpe:2.3:a:libvirt:libvirt:1.2.7:::::::*

History

13 Feb 2023, 00:41

Type	Values Removed	Values Added
References	~~{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1145667', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1145667', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/security/cve/CVE-2014-3657', 'name': 'https://access.redhat.com/security/cve/CVE-2014-3657', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2014:1873', 'name': 'https://access.redhat.com/errata/RHSA-2014:1873', 'tags': [], 'refsource': 'MISC'}~~ ~~{'url': 'https://access.redhat.com/errata/RHSA-2014:1352', 'name': 'https://access.redhat.com/errata/RHSA-2014:1352', 'tags': [], 'refsource': 'MISC'}~~
Summary	A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive.	The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

02 Feb 2023, 20:18

Type	Values Removed	Values Added
Summary	The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.	A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive.
References	{'url': 'http://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=fc22b2e74890873848b43fffae43025d22053669', 'name': 'http://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=fc22b2e74890873848b43fffae43025d22053669', 'tags': [], 'refsource': 'CONFIRM'}	(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1145667 - (MISC) https://access.redhat.com/security/cve/CVE-2014-3657 - (MISC) https://access.redhat.com/errata/RHSA-2014:1873 - (MISC) https://access.redhat.com/errata/RHSA-2014:1352 - (MISC) http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fc22b2e74890873848b43fffae43025d22053669 -

Information

Published : 2014-10-06 14:55

Updated : 2023-12-10 11:31

NVD link : CVE-2014-3657

Mitre link : CVE-2014-3657

CVE.ORG link : CVE-2014-3657

JSON object : View

Products Affected

libvirt

libvirt

CWE

CWE-399

Resource Management Errors

5.0 /10