CVE-2013-4130: Medium severity Spice Project Spice vulnerability
Currently, both redchannelpipesaddtype() and redchannelpipesaddemptymsg() use plaing RINGFOREACH() which is not safe versus removals from the ring within the loop body. Yet, when (network) error does occur, the current item could be removed from the ring down the road and the assertion in RINGFOREACH()'s ringnext() could trip, causing the process containing the spice server to abort.
An user able to initiate spice connection to the guest could use this flaw to crash the guest.
Upstream fix: http://cgit.freedesktop.org/spice/spice/commit/?id=53488f0275d6c8a121af49f7ac817d09ce68090d
Acknowledgements:
This issue was discovered by David Gibson of Red Hat.
Other sources
The (1) redchannelpipesaddtype and (2) redchannelpipesaddemptymsg functions in server/redchannel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4130?
CVE-2013-4130 is considered a moderate severity vulnerability due to potential exploitation in the red channel pipe handling.
How do I fix CVE-2013-4130?
To fix CVE-2013-4130, upgrade to the latest version of SPICE that is not affected, which is above 0.12.3.
Which versions of SPICE are affected by CVE-2013-4130?
CVE-2013-4130 affects SPICE versions from 0.5.2 up to and including 0.12.3.
What is the impact of CVE-2013-4130?
The impact of CVE-2013-4130 includes possible network errors that could lead to an unsafe removal of items from the processing ring.
Is there a workaround for CVE-2013-4130?
There are limited workarounds for CVE-2013-4130; the recommended approach is to apply the available security updates.