CVE-2014-3657 Denial of service in n/a

Medium 5.0 Published 6 Oct 2014 Updated 6 Aug 2024

Remote attackers can cause a denial of service via deadlock in libvirt by sending a NULL parameter to the virConnectListAllDomains API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-3657?

CVE-2014-3657 is a medium-severity denial of service vulnerability in n/a, published on 6 Oct 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

Weakness: CWE-399

Which versions are affected by CVE-2014-3657?

It affects 1 product.

Products include Libvirt Libvirt.

How do I fix CVE-2014-3657?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-3657 being exploited?

There is no known exploitation of CVE-2014-3657 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2014-3657, GHSA-543q-9rm2-x5f3, UBUNTU-CVE-2014-3657.