CVE-2013-4154: Null Pointer Dereference
If users haven't configured guest agent then qemuAgentCommand() will dereference a NULL 'mon' pointer.
A remote user able to issue commands to libvirt daemon could use this flaw to crash libvirtd.
References: https://bugzilla.redhat.com/showbug.cgi?id=984821 https://www.redhat.com/archives/libvir-list/2013-July/msg00992.html
Acknowledgements:
This issue was discovered by Alex Jia of Red Hat.
Other sources
The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to "agent based cpu (un)plug," as demonstrated by the "virsh vcpucount foobar --guest" command.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4154?
CVE-2013-4154 has been classified as a high severity vulnerability due to the potential for a remote attacker to crash the libvirtd daemon.
How do I fix CVE-2013-4154?
To mitigate CVE-2013-4154, you should upgrade to a patched version of Red Hat Libvirt that addresses this vulnerability.
Which versions of Red Hat Libvirt are affected by CVE-2013-4154?
CVE-2013-4154 affects Red Hat Libvirt versions up to and including 1.1.0 and specific versions below that.
What is the impact of exploiting CVE-2013-4154?
Exploiting CVE-2013-4154 allows a remote user to crash the libvirtd service, leading to denial of service.
Is a guest agent required to be affected by CVE-2013-4154?
Yes, the vulnerability arises if users haven't configured the guest agent, which leads to a NULL pointer dereference.