CVE-2013-4154 — Redhat Libvirt vulnerability

8 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
0.7%
top 27.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Libvirt
Timeline
PublishedSep 30
Latest updateMay 17

Description

The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to "agent based cpu (un)plug," as demonstrated by the "virsh vcpucount foobar --guest" command.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶Debianredhat/libvirt< 1.1.0-4+3
▶NVDredhat/libvirt1.1.0+7

Patches

Patch: openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-99hg-84w9-fwh7: The qemuAgentCommand function in libvirt before 1↗2022-05-17
▶
CVEList
CVE-2013-4154: The qemuAgentCommand function in libvirt before 1↗2013-09-30
▶
OSV
CVE-2013-4154: The qemuAgentCommand function in libvirt before 1↗2013-09-30
▶

📋Vendor Advisories

2
Red Hat
libvirt: crash of libvirtd without guest agent configuration↗2013-07-16
▶
Debian
CVE-2013-4154: libvirt - The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not...↗2013
▶

💬Community

2
Bugzilla
libvirt: CVE-2013-4154 libvirt: crash of libvirtd without guest agent configuration [fedora-all]↗2013-07-19
▶
Bugzilla
CVE-2013-4154 libvirt: crash of libvirtd without guest agent configuration↗2013-07-19
▶
CVE-2013-4154 — Redhat Libvirt vulnerability | cvebase