CVE-2013-4239: Double Free
Commit 632180d1 introduced memory corruption in xenDaemonListDefinedDomains() by starting to populate the names array at index -1, causing all sorts of havoc in libvirtd such as aborts like the following
Error in /usr/sbin/libvirtd': double free or corruption (out): 0x00007fffe00ccf20
The xenDaemonListDefinedDomains() function is reached by the virConnectListDefinedDomains() public API, which can be used on read-only connections.
Introduced in: libvirt v1.1.1
Introduced by: http://libvirt.org/git/?p=libvirt.git;a=commit;h=632180d1
Fixed by: http://libvirt.org/git/?p=libvirt.git;a=commit;h=0e671a16
Other sources
The xenDaemonListDefinedDomains function in xen/xendinternal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of service (memory corruption and crash) via vectors involving the virConnectListDefinedDomains API function.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4239?
CVE-2013-4239 is categorized as a medium severity vulnerability due to potential memory corruption issues that can lead to application crashes.
How do I fix CVE-2013-4239?
To fix CVE-2013-4239, update to a patched version of libvirt that resolves the memory corruption issue introduced by commit 632180d1.
What systems are affected by CVE-2013-4239?
CVE-2013-4239 affects Red Hat libvirt version 1.1.1 specifically.
What kind of issues can CVE-2013-4239 cause?
CVE-2013-4239 can cause memory corruption leading to application aborts and instability in libvirtd.
Is there a workaround for CVE-2013-4239?
There are no recommended workarounds for CVE-2013-4239; the best course of action is to apply the security updates promptly.