CVE-2013-1962
First published: Wed Apr 17 2013(Updated: )
A denial of service flaw was found in the way storage pool manager of libvirt, a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes), performed management of socket file descriptors when 'to list all volumes for the particular pool' request was issued (two socket file descriptors were leaked per "list all pool volumes" request). An uprivileged user could use this flaw to cause denial of service (make libvirtd daemon to exhaust / reach the maximum count of open file descriptors, the libvirtd daemon process was allowed to open, possibly preventing other users from use of libvirtd services till the libvirtd daemon was restarted). Acknowledgements: Red Hat would like to thank Edoardo Comar of IBM for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Libvirt | =1.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=736816&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=736816&action=edit
- https://access.redhat.com/security/cve/CVE-2013-1962
- https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html
- https://rhn.redhat.com/errata/RHSA-2013-0831.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=963789
- https://bugzilla.redhat.com/show_bug.cgi?id=953107
- http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=ca697e90d5bd6a6dfb94bfb6d4438bdf9a44b739
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106906.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106921.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00022.html
- http://osvdb.org/93451
- http://rhn.redhat.com/errata/RHSA-2013-0831.html
- http://secunia.com/advisories/53440
- http://secunia.com/advisories/53475
- http://www.openwall.com/lists/oss-security/2013/05/16/9
- http://www.securityfocus.com/bid/59937
- http://www.securitytracker.com/id/1028577
- http://www.ubuntu.com/usn/USN-1895-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/84341
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-1962
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/tags
- agent/description
- agent/event
- vendor/redhat
- canonical/redhat libvirt
- version/redhat libvirt/1.0.5