CVE-2013-1962
published 2013-05-29CVE-2013-1962: The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file…
PriorityP424medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
3.51%
87.9th percentile
The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libvirt | — | — |
| redhat | libvirt | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libvirt vulnerability
vendor_ubuntu·2013-07-02
CVE-2013-1962 libvirt vulnerability
Title: libvirt vulnerability
Summary: libvirt could be made to crash if it received specially crafted network
traffic.
It was discovered that libvirt incorrectly handled certain storage pool
requests. A remote attacker could use this issue to cause libvirt to
consume resources, resulting in a denial of service.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool
vendor_redhat·2013-05-16·CVSS 5.0
CVE-2013-1962 [MEDIUM] libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool
libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool
The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."
Package: libvirt (Red Hat Enterprise Linux 5) - Not affected
Debian
CVE-2013-1962: libvirt - The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager...
vendor_debian·2013·CVSS 5.0
CVE-2013-1962 [MEDIUM] CVE-2013-1962: libvirt - The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager...
The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-6vm5-9cgm-26rc: The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1
ghsa_unreviewed·2022-05-17
CVE-2013-1962 [MEDIUM] GHSA-6vm5-9cgm-26rc: The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1
The remoteDispatchStoragePoolListAllVolumes function in the storage pool manager in libvirt 1.0.5 allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of requests "to list all volumes for the particular pool."
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool [fedora-all]
bugzilla·2013-05-16·CVSS 5.0
CVE-2013-1962 [MEDIUM] CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool [fedora-all]
CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when ava
Bugzilla
CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool
bugzilla·2013-04-17·CVSS 5.0
CVE-2013-1962 [MEDIUM] CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool
CVE-2013-1962 libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool
A denial of service flaw was found in the way storage pool manager of libvirt, a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes), performed management of socket file descriptors when 'to list all volumes for the particular pool' request was issued (two socket file descriptors were leaked per "list all pool volumes" request). An uprivileged user could use this flaw to cause denial of service (make libvirtd daemon to exhaust / reach the maximum count of open file descriptors, the libvirtd daemon process was allowed to open, possibly preventing other users from use of libvirtd services till the libvirtd daemon was restarted).
Acknowledg
http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=ca697e90d5bd6a6dfb94bfb6d4438bdf9a44b739http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106906.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-May/106921.htmlhttp://lists.opensuse.org/opensuse-updates/2013-06/msg00022.htmlhttp://osvdb.org/93451http://rhn.redhat.com/errata/RHSA-2013-0831.htmlhttp://secunia.com/advisories/53440http://secunia.com/advisories/53475http://www.openwall.com/lists/oss-security/2013/05/16/9http://www.securityfocus.com/bid/59937http://www.securitytracker.com/id/1028577http://www.ubuntu.com/usn/USN-1895-1https://bugzilla.redhat.com/show_bug.cgi?id=953107https://exchange.xforce.ibmcloud.com/vulnerabilities/84341https://www.redhat.com/archives/libvir-list/2013-May/msg01222.htmlhttp://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=ca697e90d5bd6a6dfb94bfb6d4438bdf9a44b739http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106906.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-May/106921.htmlhttp://lists.opensuse.org/opensuse-updates/2013-06/msg00022.htmlhttp://osvdb.org/93451http://rhn.redhat.com/errata/RHSA-2013-0831.htmlhttp://secunia.com/advisories/53440http://secunia.com/advisories/53475http://www.openwall.com/lists/oss-security/2013/05/16/9http://www.securityfocus.com/bid/59937http://www.securitytracker.com/id/1028577http://www.ubuntu.com/usn/USN-1895-1https://bugzilla.redhat.com/show_bug.cgi?id=953107https://exchange.xforce.ibmcloud.com/vulnerabilities/84341https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html
2013-05-29
Published