CVE-2013-6456 Path traversal in n/a

What is CVE-2013-6456?

CVE-2013-6456 is a medium-severity path traversal vulnerability in Fedoraproject Fedora, published on 15 Apr 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.

Weakness: CWE-59

Which versions are affected by CVE-2013-6456?

It affects 2 products.

Products include Fedoraproject Fedora, Redhat Libvirt.

How do I fix CVE-2013-6456?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2013-6456 being exploited?

There is no known exploitation of CVE-2013-6456 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-6456, GHSA-4c8j-w686-c2jw.