CVE-2013-4399: Use After Free
The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4399?
CVE-2013-4399 has a medium severity rating due to its potential for causing a denial of service through a use-after-free vulnerability.
How do I fix CVE-2013-4399?
To fix CVE-2013-4399, upgrade libvirt to version 1.1.3 or later, which includes the necessary patches.
Who is affected by CVE-2013-4399?
CVE-2013-4399 affects Red Hat libvirt versions prior to 1.1.3 and several specific earlier versions.
What type of vulnerability is CVE-2013-4399?
CVE-2013-4399 is a use-after-free vulnerability affecting the event handler removal in libvirt when ACLs are used.
Can CVE-2013-4399 be exploited remotely?
Yes, CVE-2013-4399 can be exploited remotely by attackers to cause a denial of service.