CVE-2012-3445: Low severity redhat libvirt vulnerability
It has been found that sending crafted RPC command with nparams set to 0 can lead to libvirtd accessing random memory, possibly leading to crash. A remote attacker could use this flaw to crash libvirtd (DoS).
Upstream proposed fix: https://www.redhat.com/archives/libvir-list/2012-July/msg01650.html
Other sources
The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain API calls with typed parameters, which might allow remote authenticated users to cause a denial of service (libvirtd crash) via an RPC command with nparams set to zero, which triggers an out-of-bounds read or a free of an invalid pointer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3445?
CVE-2012-3445 has a severity rating that indicates it can lead to a denial of service (DoS) due to potential crashing of libvirtd.
How do I fix CVE-2012-3445?
To fix CVE-2012-3445, upgrade to a patched version of libvirt that addresses this vulnerability.
What software does CVE-2012-3445 affect?
CVE-2012-3445 affects Red Hat Libvirt version 0.9.13.
Can CVE-2012-3445 be exploited remotely?
Yes, CVE-2012-3445 can be exploited by a remote attacker to crash the libvirtd service.
What are the consequences of CVE-2012-3445 being exploited?
The exploitation of CVE-2012-3445 can lead to a denial of service, causing libvirtd to become unavailable.