Unscored severity · published Jan 24, 2014
CVE-2013-6458
Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do…
–
CVSS
0.6%
EPSS
No
On KEV
Description
Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libvirt · Redhat
through 1.2.0; 0.0.1; 0.0.2; 0.0.3; 0.0.4; 0.0.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6458
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6458
libvirt.org
http://libvirt.org/news.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-02/msg00062.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-0103.html
Vendor Advisory
http://secunia.com/advisories/56186
Vendor Advisory
http://secunia.com/advisories/56446
More from Libvirt
9.8
CVE-2016-5008
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and…
8.8
CVE-2020-14339
A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process
8.8
CVE-2019-10132
A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units
8.1
CVE-2017-1000256
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates…
7.8
CVE-2019-10168
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the…