CVE-2013-4377: Use After Free
A dangling pointer access flaw was found in the way qemu handled hot-unplugging virtio devices. This flaw was introduced by virtio refactoring and exists in the virtio-pci implementation. When the virtio-blk-pci device is deleted, the virtio-blk-device is removed first (removal is done in post-order). Later, the virtio-blk-device is accessed again, but proxy->vdev->vq is no longer valid (a dangling pointer) and kvmsetioeventfdpio fails.
A privileged guest user could use this flaw to crash the qemu process on the host system, causing a denial of service to it and any other running virtual machines.
Patches are available at http://thread.gmane.org/gmane.comp.emulators.qemu/234440
Acknowledgements:
This issue was discovered by Sibiao Luo of Red Hat.
Other sources
Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a virtio device.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4377?
CVE-2013-4377 is considered a high severity vulnerability due to the risk of arbitrary code execution caused by a dangling pointer access.
How do I fix CVE-2013-4377?
To fix CVE-2013-4377, upgrade QEMU to version 1.6.0 or later, as it includes the necessary patches.
Which versions of QEMU are affected by CVE-2013-4377?
CVE-2013-4377 affects QEMU versions 1.4.0 through 1.6.0-rc3.
What type of vulnerability is CVE-2013-4377?
CVE-2013-4377 is a dangling pointer access flaw specific to the virtio-pci implementation.
Can CVE-2013-4377 lead to data loss?
Yes, CVE-2013-4377 can potentially lead to data loss by allowing attackers to execute arbitrary code when hot-unplugging virtio devices.