libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
It has been found that sending RPC message with an event as the RPC number, or RPC number that falls into gap in the RPC dispatch table, can lead to libvirtd accessing memory at page zero. A remote attacker could use this flaw to crash libvirtd (DoS).
Proposed upstream fix: https://www.redhat.com/archives/libvir-list/2012-September/msg00843.html
If users haven't configured guest agent then qemuAgentCommand() will dereference a NULL 'mon' pointer.
A remote user able to issue commands to libvirt daemon could use this flaw to crash libvirtd.
References: https://bugzilla.redhat.com/showbug.cgi?id=984821 https://www.redhat.com/archives/libvir-list/2013-July/msg00992.html
Acknowledgements:
This issue was discovered by Alex Jia of Red Hat.
A part of the returned monitor response was freed twice and caused crashes of the daemon when using guest agent cpu count retrieval.
A remote user able to issue commands to libvirt daemon could use this flaw to crash libvirtd or, potentially, escalate their privilages to that of libvirtd process.
References: https://bugzilla.redhat.com/showbug.cgi?id=984821 https://www.redhat.com/archives/libvir-list/2013-July/msg01035.html
Acknowledgements:
This issue was discovered by Petr Krempa of Red Hat.
It has been found that sending crafted RPC command with nparams set to 0 can lead to libvirtd accessing random memory, possibly leading to crash. A remote attacker could use this flaw to crash libvirtd (DoS).
Upstream proposed fix: https://www.redhat.com/archives/libvir-list/2012-July/msg01650.html