REDHAT-BUG-1006173: Medium severity libvirt vulnerability
The 'stats' variable in remoteDispatchDomainMemoryStats function was not initialized to NULL, so if some early validation of the RPC call fails, it is possible to jump to the 'cleanup' label and VIRFREE an uninitialized pointer.
A remote user able to issue commands to libvirt daemon could use this flaw to crash libvirtd.
Acknowledgements:
This issue was discovered by Daniel P. Berrange of Red Hat.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1006173?
The severity of REDHAT-BUG-1006173 is categorized as a potential security vulnerability due to the risk of dereferencing an uninitialized pointer.
How do I fix REDHAT-BUG-1006173?
To fix REDHAT-BUG-1006173, ensure that the 'stats' variable is properly initialized to NULL before it is used in the remoteDispatchDomainMemoryStats function.
Who is affected by REDHAT-BUG-1006173?
Users of Red Hat libvirt who allow remote users to issue commands to the libvirt daemon are affected by REDHAT-BUG-1006173.
What can attackers exploit in REDHAT-BUG-1006173?
Attackers can exploit REDHAT-BUG-1006173 to potentially cause a denial of service by triggering the uninitialized pointer dereference in the remoteDispatchDomainMemoryStats function.
Is there a patch available for REDHAT-BUG-1006173?
Yes, a patch to address the vulnerability in REDHAT-BUG-1006173 is typically provided in subsequent updates to the affected libvirt package.