CVE-2013-0241
First published: Wed Jan 30 2013(Updated: )
A flaw was found in the way spice connection breakups were handled in the qemu-kvm qxl driver. Some of the qxl port i/o commands were waiting for the spice server to complete the actions, while the corresponding thread holds qemu_mutex mutex, potentially blocking other threads in the guest's qemu-kvm process. An user able to initiate spice connection to the guest could use this flaw to make guest temporarily unavailable or, in case kernel.softlockup_panic in the guest was set, crash the guest. Upstream fixes: xf86-video-qxl commit <a href="http://cgit.freedesktop.org/xorg/driver/xf86-video-qxl/commit/?id=30b4b72cdbdf9f0e92a8d1c4e01779f60f15a741">http://cgit.freedesktop.org/xorg/driver/xf86-video-qxl/commit/?id=30b4b72cdbdf9f0e92a8d1c4e01779f60f15a741</a> which relies on qemu-kvm functionality introduced by commit <a href="http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=5ff4e36c">http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=5ff4e36c</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| xf86-video-qxl | =0.1.0 | |
| Ubuntu Linux | =11.10 | |
| Ubuntu Linux | =12.04 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Workstation | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cgit.freedesktop.org/xorg/driver/xf86-video-qxl/commit/?id=30b4b72cdbdf9f0e92a8d1c4e01779f60f15a741
- http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=5ff4e36c
- https://rhn.redhat.com/errata/RHSA-2013-0218.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=906032#c2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=906032#c0
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=906032#c3
- https://bugzilla.redhat.com/show_bug.cgi?id=906032
- http://rhn.redhat.com/errata/RHSA-2013-0218.html
- http://secunia.com/advisories/52021
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:138
- http://www.openwall.com/lists/oss-security/2013/01/30/3
- http://www.openwall.com/lists/oss-security/2013/01/30/4
- http://www.ubuntu.com/usn/USN-1714-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/81704
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0036
Frequently Asked Questions
What is the severity of CVE-2013-0241?
CVE-2013-0241 has a medium severity rating due to potential denial of service risks in affected systems.
How do I fix CVE-2013-0241?
To fix CVE-2013-0241, upgrade to the latest version of the qxl driver or apply the relevant patches provided by your distribution.
Which software is affected by CVE-2013-0241?
CVE-2013-0241 affects various versions of the qxl graphics driver and specific versions of Ubuntu and Red Hat Linux distributions.
What are the potential impacts of CVE-2013-0241?
The potential impacts of CVE-2013-0241 include performance degradation and service interruption in virtualized environments.
Is CVE-2013-0241 still a threat?
CVE-2013-0241 could still pose a threat if vulnerable systems remain unpatched, particularly in environments using affected versions.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-0241
- agent/trending
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- vendor/qxl graphics driver project
- canonical/xf86-video-qxl
- version/xf86-video-qxl/0.1.0
- vendor/canonical
- canonical/ubuntu linux
- version/ubuntu linux/11.10
- version/ubuntu linux/12.04
- vendor/redhat
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0