CVE-2013-6458 Race condition in n/a

What is CVE-2013-6458?

CVE-2013-6458 is a medium-severity vulnerability in Redhat Libvirt, published on 24 Jan 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.

Weakness: CWE-362

Which versions are affected by CVE-2013-6458?

It affects 1 product.

Products include Redhat Libvirt.

How do I fix CVE-2013-6458?

Upgrade to a fixed version.

Is CVE-2013-6458 being exploited?

There is no known exploitation of CVE-2013-6458 in the wild and no public exploit code.

Other vulnerabilities in Redhat Libvirt

• CVE-2013-4401 Missing authorization in n/a High 8.5
• CVE-2017-2635 Null dereference in libvirt High 7.7
• CVE-2013-4400 Privilege escalation in n/a High 7.2
• CVE-2013-4291 Privilege escalation in n/a Medium 6.9
• CVE-2011-1146 Missing authorization in n/a Medium 6.9

All Redhat Libvirt vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-6458, GHSA-9hqh-qqff-45p6.