CVE-2013-6458 — Race Condition in Redhat Libvirt

CWE-362 — Race Condition10 documents8 sources
Severity
6.8MEDIUMNVD
EPSS
0.9%
top 24.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Libvirt
Timeline
PublishedJan 24
Latest updateMay 17

Description

Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.

CVSS vector

AV:A/AC:H/C:C/I:C/A:CExploitability: 3.2 | Impact: 10.0

Affected Packages2 packages

▶Debianredhat/libvirt< 1.2.1-1+3
▶NVDredhat/libvirt1.2.0+109

🔴Vulnerability Details

3
GHSA
GHSA-9hqh-qqff-45p6: Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functio↗2022-05-17
▶
CVEList
CVE-2013-6458: Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functio↗2014-01-24
▶
OSV
CVE-2013-6458: Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functio↗2014-01-24
▶

📋Vendor Advisories

3
Ubuntu
libvirt vulnerabilities↗2014-01-30
▶
Red Hat
qemu: job usage issue in several APIs leading to libvirtd crash↗2013-12-13
▶
Debian
CVE-2013-6458: libvirt - Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockIn...↗2013
▶

💬Community

3
Bugzilla
CVE-2013-6458 libvirt: qemu: job usage issue in several APIs leading to libvirtd crash [fedora-all]↗2014-01-16
▶
Bugzilla
CVE-2013-6458 qemu: job usage issue in several APIs leading to libvirtd crash↗2014-01-06
▶
Bugzilla
CVE-2013-6458 libvirtd crashes when swapping disks in qemu guest multiple times - qemuMonitorJSONGetBlockStatsInfo segfault [rhel-6.6]↗2013-12-13
▶
CVE-2013-6458 — Race Condition in Redhat Libvirt | cvebase