CVE-2014-3657: Medium severity oracle libvirt vulnerability
The virDomainListPopulate function in conf/domainconf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3657?
CVE-2014-3657 is classified with a severity that allows remote attackers to cause a denial of service through a deadlock.
How do I fix CVE-2014-3657?
To mitigate CVE-2014-3657, upgrade to libvirt version 1.2.9 or later to address the vulnerability.
Which versions of libvirt are affected by CVE-2014-3657?
CVE-2014-3657 affects libvirt versions prior to 1.2.9, including versions 1.2.0 through 1.2.8.
What kind of attack can be executed using CVE-2014-3657?
CVE-2014-3657 allows remote attackers to exploit a NULL value in the virConnectListAllDomains API command, leading to a denial of service.
What component contains the vulnerability CVE-2014-3657?
The vulnerability CVE-2014-3657 is found in the virDomainListPopulate function in conf/domain_conf.c within the libvirt codebase.