CVE-2013-7336 Null dereference in n/a

Low 1.9 Published 7 May 2014 Updated 6 Aug 2024

Local users can crash libvirtd via a NULL pointer dereference during SPICE migration, causing denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2013-7336?

CVE-2013-7336 is a low-severity vulnerability in Opensuse Opensuse, published on 7 May 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.

Which versions are affected by CVE-2013-7336?

It affects 2 products.

Linux distribution packages (25)

`libvirt` Red Hat:enterprise_linux:6::client	All versions	`0:0.10.2-29.el6`
`libvirt-client` Red Hat:enterprise_linux:6::client	All versions	`0:0.10.2-29.el6`
`libvirt-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:0.10.2-29.el6`
`libvirt-devel` Red Hat:enterprise_linux:6::client	All versions	`0:0.10.2-29.el6`
`libvirt-lock-sanlock` Red Hat:enterprise_linux:6::client	All versions	`0:0.10.2-29.el6`
`libvirt-python` Red Hat:enterprise_linux:6::client	All versions	`0:0.10.2-29.el6`
`libvirt` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.10.2-29.el6`
`libvirt-client` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.10.2-29.el6`
`libvirt-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.10.2-29.el6`
`libvirt-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.10.2-29.el6`
`libvirt-lock-sanlock` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.10.2-29.el6`
`libvirt-python` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.10.2-29.el6`
`libvirt` Red Hat:enterprise_linux:6::server	All versions	`0:0.10.2-29.el6`
`libvirt-client` Red Hat:enterprise_linux:6::server	All versions	`0:0.10.2-29.el6`
`libvirt-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:0.10.2-29.el6`
`libvirt-devel` Red Hat:enterprise_linux:6::server	All versions	`0:0.10.2-29.el6`
`libvirt-lock-sanlock` Red Hat:enterprise_linux:6::server	All versions	`0:0.10.2-29.el6`
`libvirt-python` Red Hat:enterprise_linux:6::server	All versions	`0:0.10.2-29.el6`
`libvirt` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.10.2-29.el6`
`libvirt-client` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.10.2-29.el6`
`libvirt-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.10.2-29.el6`
`libvirt-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.10.2-29.el6`
`libvirt-lock-sanlock` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.10.2-29.el6`
`libvirt-python` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.10.2-29.el6`
`libvirt-lock-sanlock` Red Hat:storage:3:server:el6	All versions	`0:0.10.2-29.el6`

Products include Opensuse Opensuse, Redhat Libvirt.

How do I fix CVE-2013-7336?

Upgrade to a fixed version.

Is CVE-2013-7336 being exploited?

There is no known exploitation of CVE-2013-7336 in the wild and no public exploit code.

All Opensuse Opensuse vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-7336, GHSA-xjqc-jjx2-53jr, RHBA-2013:1581.