libvirt 'virDomainBlockStats()' Denial of Service Vulnerability

Bugtraq ID:	64723
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-6458
Remote:	Yes
Local:	No
Published:	Dec 13 2013 12:00AM
Updated:	Apr 13 2015 09:51PM
Credit:	Alexandre Mclean
Vulnerable:	Ubuntu Ubuntu Linux 13.10 Ubuntu Ubuntu Linux 12.10 Ubuntu Ubuntu Linux 12.04 LTS Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 openSUSE openSUSE 12.3 libvirt libvirt 0.10.2 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6
Not Vulnerable:

libvirt 'virDomainBlockStats()' Denial of Service Vulnerability

libvirt is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the application that uses the affected library, denying service to legitimate users.

libvirt 'virDomainBlockStats()' Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

libvirt 'virDomainBlockStats()' Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

libvirt 'virDomainBlockStats()' Denial of Service Vulnerability

References:

• Bug 1048631 - (CVE-2013-6458) CVE-2013-6458 qemu: job usage issue in several API (Red Hat Bugzilla)
  
• libvirt Homepage (Ubuntu)
  
• qemu: Do not access stale data in virDomainBlockStats (Jiri Denemark )