CVE-2013-4154 Null dereference in n/a

Medium 4.3 Published 30 Sep 2013 Updated 6 Aug 2024

Remote attackers can crash the libvirt daemon via a NULL pointer dereference when the guest agent is unconfigured, causing denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-4154?

CVE-2013-4154 is a medium-severity vulnerability in Redhat Libvirt, published on 30 Sep 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to "agent based cpu (un)plug," as demonstrated by the "virsh vcpucount foobar --guest" command.

Which versions are affected by CVE-2013-4154?

It affects 1 product.

Products include Redhat Libvirt.

How do I fix CVE-2013-4154?

Upgrade to a fixed version.

Is CVE-2013-4154 being exploited?

There is no known exploitation of CVE-2013-4154 in the wild and no public exploit code.

All Redhat Libvirt vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-4154, GHSA-99hg-84w9-fwh7.