Denial Of Service (DoS)

2018-08-1307:58:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

libvirt.so is vulnerable to denial of service (DoS). The virDomainListPopulate function in conf/domain_conf.c does not clean up the lock on the list of domains. This allows a remote attacker to cause a deadlock by passing a NULL list parameter to virConnectListAllDomains which leads to an early jump to the cleanup label and consequently preventing all further APIs from accessing the list.

CPENameOperatorVersion
libvirt.sole0.2000.0
libvirteq0.8.1__27.el6_0.6
libvirteq0.10.2__29.el6_5.12
libvirteq0.10.2__29.el6_5.4
libvirteq0.8.1__27.el6
libvirteq0.10.2__29.el6
libvirteq0.9.4__23.el6_2.8
libvirteq0.10.2__29.el6_5.11
libvirteq0.9.4__23.el6
libvirteq0.9.4__23.el6_2.6

Name	Operator	Version
libvirt.so	le	0.2000.0
libvirt	eq	0.8.1__27.el6_0.6
libvirt	eq	0.10.2__29.el6_5.12
libvirt	eq	0.10.2__29.el6_5.4
libvirt	eq	0.8.1__27.el6
libvirt	eq	0.10.2__29.el6
libvirt	eq	0.9.4__23.el6_2.8
libvirt	eq	0.10.2__29.el6_5.11
libvirt	eq	0.9.4__23.el6
libvirt	eq	0.9.4__23.el6_2.6