CVE-2013-4153 — Double Free in Redhat Libvirt

CWE-3998 documents7 sources
Severity
5.0MEDIUMNVD
EPSS
0.6%
top 29.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Libvirt
Timeline
PublishedSep 30
Latest updateMay 17

Description

Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c in libvirt 1.0.6 through 1.1.0 allows remote attackers to cause a denial of service (daemon crash) via a cpu count request, as demonstrated by the "virsh vcpucount dom --guest" command.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Debianredhat/libvirt< 1.1.0-4+3
▶NVDredhat/libvirt1.0.6, 1.1.0+1

Patches

Patch: openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-rgq3-5v68-49wc: Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent↗2022-05-17
▶
OSV
CVE-2013-4153: Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent↗2013-09-30
▶
CVEList
CVE-2013-4153: Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent↗2013-09-30
▶

📋Vendor Advisories

2
Red Hat
libvirt: double free of returned JSON array in qemuAgentGetVCPUs()↗2013-07-16
▶
Debian
CVE-2013-4153: libvirt - Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c...↗2013
▶

💬Community

2
Bugzilla
CVE-2013-4153 libvirt: double free of returned JSON array in qemuAgentGetVCPUs()↗2013-07-19
▶
Bugzilla
libvirt: CVE-2013-4153 libvirt: double free of returned JSON array in qemuAgentGetVCPUs() [fedora-all]↗2013-07-19
▶
CVE-2013-4153 — Double Free in Redhat Libvirt | cvebase