CVE-2013-4311 — Race Condition in Redhat Libvirt

9 documents8 sources
Severity
4.6MEDIUMNVD
CNA7.2OSV7.2
EPSS
0.0%
top 93.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat LibvirtCanonical Ubuntu LinuxRedhat Enterprise Linux
Timeline
PublishedOct 3
Latest updateMay 14

Description

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages2 packages

▶Debianredhat/libvirt< 1.1.3~rc1-1+3
▶NVDredhat/libvirt15 versions+14

Also affects: Ubuntu Linux 10.04, 12.04, 12.10, 13.04, Enterprise Linux 6.0

Patches

Patch: wiki.libvirt.org ↗Patch: wiki.libvirt.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-pr6p-rw96-x62r: libvirt 1↗2022-05-14
▶
OSV
CVE-2013-4311: libvirt 1↗2013-10-03
▶
CVEList
CVE-2013-4311: libvirt 1↗2013-10-03
▶

📋Vendor Advisories

3
Ubuntu
libvirt vulnerabilities↗2013-09-18
▶
Red Hat
libvirt: insecure calling of polkit↗2013-09-18
▶
Debian
CVE-2013-4311: libvirt - libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0....↗2013
▶

💬Community

2
Bugzilla
CVE-2013-4311 libvirt: insecure calling of polkit [fedora-all]↗2013-09-18
▶
Bugzilla
CVE-2013-4311 libvirt: insecure calling of polkit↗2013-09-06
▶
CVE-2013-4311 — Race Condition in Redhat Libvirt | cvebase