CVE-2013-0170: Use After Free
A flaw was found in the way message freeing on connection cleanup was handled under certain error conditions. A remote user able to issue commands to libvirt daemon could use this flaw to crash libvirtd or, potentially, escalate their privilages to that of libvirtd process.
Acknowledgements:
This issue was discovered by Tingting Zheng of Red Hat.
Other sources
Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0170?
CVE-2013-0170 has a severity level that indicates it may allow remote users to crash the libvirtd service or potentially escalate privileges.
Which versions are affected by CVE-2013-0170?
Versions of Red Hat Libvirt prior to 0.9.6.4, between 0.9.6 and 0.9.11.9, between 0.10.2 and 1.0.2, as well as several versions of openSUSE and Fedora are affected.
How do I fix CVE-2013-0170?
To fix CVE-2013-0170, users should upgrade to the latest version of the affected software that addresses the vulnerability.
Is CVE-2013-0170 exploitable remotely?
Yes, CVE-2013-0170 can be exploited remotely by users who can issue commands to the libvirt daemon.
What impact does CVE-2013-0170 have on system security?
CVE-2013-0170 can potentially lead to denial-of-service conditions or privilege escalation, compromising system security.