CVE-2014-3633: Buffer Overflow
The qemuDomainGetBlockIoTune function in qemu/qemudriver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3633?
CVE-2014-3633 is classified as a denial of service vulnerability that can crash the application or leak sensitive heap information.
How do I fix CVE-2014-3633?
To fix CVE-2014-3633, update libvirt to version 1.2.9 or later as it contains the necessary patches.
Which software versions are affected by CVE-2014-3633?
CVE-2014-3633 affects libvirt versions up to and including 1.2.8 and several Ubuntu Linux versions including 10.04, 12.04, and 14.04.
Can CVE-2014-3633 be exploited remotely?
Yes, CVE-2014-3633 can be exploited by remote attackers via crafted blkiotune queries.
What can happen if CVE-2014-3633 is exploited?
Exploitation of CVE-2014-3633 may lead to application crashes or exposure of sensitive information from the heap.