Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption.

Description of problem: When several libvirtd threads are reporting errors at the same time, the errors can get mixed or corrupted, potentially leading to a libvirtd crash (DoS).

Upstream commit: https://www.redhat.com/archives/libvir-list/2011-March/msg01087.html

The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap, as demonstrated by a large nodeset value to numatune.

The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection.

The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and earlier allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via unspecified vectors.

A flaw was found in the way multiple events registration were handled in libvirt qemu driver.

A remote user able to issue commands to libvirt daemon could use this flaw to crash libvirtd.

Acknowledgements:

This issue was discovered by Zhenfeng Wang of Red Hat.

libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.