Vulnerabilities > CVE-2013-4296 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt 0.9.1 through 0.10.1.x, 0.10.2.x before 0.10.2.8, 1.0.x before 1.0.5.6, and 1.1.x before 1.1.2 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a crafted RPC call.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Scientific Linux Local Security Checks NASL id SL_20130919_LIBVIRT_ON_SL6_X.NASL description libvirt invokes the PolicyKit pkcheck utility to handle authorization. A race condition was found in the way libvirt used this utility, allowing a local user to bypass intended PolicyKit authorizations or execute arbitrary commands with root privileges. (CVE-2013-4311) Note: With this update, libvirt has been rebuilt to communicate with PolicyKit via a different API that is not vulnerable to the race condition. The polkit SLSA-2013:1270 advisory must also be installed to fix the CVE-2013-4311 issue. An invalid free flaw was found in libvirtd last seen 2020-03-18 modified 2013-09-20 plugin id 70015 published 2013-09-20 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70015 title Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20130919) NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-763.NASL description libvirt was updated to fix security issues and bugs : Security issues fixed: CVE-2013-4311: Add support for using 3-arg pkcheck syntax for process to avoid race conditions. CVE-2013-4296: Fix a crash (denial of service) in remoteDispatchDomainMemoryStats CVE-2013-5651: Fix virBitmapParse to avoid access beyond bounds of array (denial of service crash). Also bugs were fixed : - nwfilter: check for inverted ctdir. bnc#810611 - Add xencommons as last seen 2020-06-05 modified 2014-06-13 plugin id 75168 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75168 title openSUSE Security Update : libvirt (openSUSE-SU-2013:1550-1) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2013-1460.NASL description An updated rhev-hypervisor6 package that fixes one security issue and various bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. Upgrade Note: If you upgrade the Red Hat Enterprise Virtualization Hypervisor through the 3.2 Manager administration portal, the Host may appear with the status of last seen 2020-06-01 modified 2020-06-02 plugin id 78977 published 2014-11-08 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78977 title RHEL 6 : rhev-hypervisor6 (RHSA-2013:1460) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2013-1272.NASL description Updated libvirt packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. libvirt invokes the PolicyKit pkcheck utility to handle authorization. A race condition was found in the way libvirt used this utility, allowing a local user to bypass intended PolicyKit authorizations or execute arbitrary commands with root privileges. (CVE-2013-4311) Note: With this update, libvirt has been rebuilt to communicate with PolicyKit via a different API that is not vulnerable to the race condition. The polkit RHSA-2013:1270 advisory must also be installed to fix the CVE-2013-4311 issue. An invalid free flaw was found in libvirtd last seen 2020-06-01 modified 2020-06-02 plugin id 70011 published 2013-09-20 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70011 title RHEL 6 : libvirt (RHSA-2013:1272) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201412-04.NASL description The remote host is affected by the vulnerability described in GLSA-201412-04 (libvirt: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details. Impact : A remote attacker may be able to cause a Denial of Service or cause information leakage. A local attacker may be able to escalate privileges, cause a Denial of Service or possibly execute arbitrary code. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 79814 published 2014-12-09 reporter This script is Copyright (C) 2014-2015 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/79814 title GLSA-201412-04 : libvirt: Multiple vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_11_LIBVIRT-130923.NASL description This libvirt update fixes a security issue. - EMBARGOED: libvirt: Fix crash in remoteDispatchDomainMemoryStats. (bnc#838638: CVE-2013-4296) - Regression: vm-install fails to display on SLES 11 SP2 UV2000. (bnc#817008) last seen 2020-06-05 modified 2013-11-09 plugin id 70796 published 2013-11-09 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/70796 title SuSE 11.2 Security Update : libvirt (SAT Patch Number 8348) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2764.NASL description Daniel P. Berrange discovered that incorrect memory handling in the remoteDispatchDomainMemoryStats() function could lead to denial of service. The oldstable distribution (squeeze) is not affected. last seen 2020-03-17 modified 2013-09-26 plugin id 70128 published 2013-09-26 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70128 title Debian DSA-2764-1 : libvirt - programming error NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-764.NASL description libvirt was updated to fix 2 security issues : CVE-2013-4311: Add support for using 3-arg pkcheck syntax for process, which previously could be used for race conditions to gain privileges. CVE-2013-4296: Fix crash in remoteDispatchDomainMemoryStats last seen 2020-06-05 modified 2014-06-13 plugin id 75169 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75169 title openSUSE Security Update : libvirt (openSUSE-SU-2013:1549-1) NASL family Fedora Local Security Checks NASL id FEDORA_2013-17305.NASL description - Rebased to version 0.10.2.8 - CVE-2013-4311: Insecure polkit usage (bz #1009539, bz #1005332) - CVE-2013-4296: Invalid free memory stats (bz #1006173, bz #1009667) - CVE-2013-4291: Supplementary groups handling (bz #1006509, bz #1006511) - Fix LXC container creation if selinux disabled (bz #977114) - Fix virsh change-media with block disk type (bz #951192) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-10-01 plugin id 70235 published 2013-10-01 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/70235 title Fedora 18 : libvirt-0.10.2.8-1.fc18 (2013-17305) NASL family Fedora Local Security Checks NASL id FEDORA_2013-17618.NASL description - Fix snapshot restore when VM has disabled usb support (bz #1011520) - Rebased to version 1.0.5.6 - Fix blockjobinfo python API (bz #999077) - CVE-2013-4311: Insecure polkit usage (bz #1009539, bz #1005332) - CVE-2013-4296: Invalid free memory stats (bz #1006173, bz #1009667) - CVE-2013-4291: Supplementary groups handling (bz #1006509, bz #1006511) - CVE-2013-5651: virBitmapParse out-of-bounds (bz #1006493) - Fix virsh change-media with block disk type (bz #951192) - Fix changing VNC listen address (bz #1006697) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-10-03 plugin id 70279 published 2013-10-03 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/70279 title Fedora 19 : libvirt-1.0.5.6-2.fc19 (2013-17618) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1954-1.NASL description It was discovered that libvirt used the pkcheck tool in an unsafe manner. A local attacker could possibly use this flaw to bypass polkit authentication. In Ubuntu, libvirt polkit authentication is not enabled by default. (CVE-2013-4311) It was discovered that libvirt incorrectly handled certain memory stats requests. A remote attacker could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 12.10, and Ubuntu 13.04. (CVE-2013-4296) It was discovered that libvirt incorrectly handled certain bitmap operations. A remote attacker could use this issue to cause libvirt to crash, resulting in a denial of service. This issue only affected Ubuntu 13.04. (CVE-2013-5651). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 69972 published 2013-09-19 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69972 title Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : libvirt vulnerabilities (USN-1954-1) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2013-1272.NASL description From Red Hat Security Advisory 2013:1272 : Updated libvirt packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. libvirt invokes the PolicyKit pkcheck utility to handle authorization. A race condition was found in the way libvirt used this utility, allowing a local user to bypass intended PolicyKit authorizations or execute arbitrary commands with root privileges. (CVE-2013-4311) Note: With this update, libvirt has been rebuilt to communicate with PolicyKit via a different API that is not vulnerable to the race condition. The polkit RHSA-2013:1270 advisory must also be installed to fix the CVE-2013-4311 issue. An invalid free flaw was found in libvirtd last seen 2020-06-01 modified 2020-06-02 plugin id 70007 published 2013-09-20 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70007 title Oracle Linux 6 : libvirt (ELSA-2013-1272) NASL family SuSE Local Security Checks NASL id SUSE_11_LIBVIRT-131004.NASL description libvirt has been updated to the 1.0.5.6 stable release that fixes bugs and security issues : - Fix crash in remoteDispatchDomainMemoryStats. (CVE-2013-4296) - virBitmapParse out-of-bounds read access Libvirt on SLES 11 SP3 is not affected:. (CVE-2013-5651) - Add support for using 3-arg pkcheck syntax for process (). (CVE-2013-4311) - security: provide supplemental groups even when parsing label () Changes in this version:. (CVE-2013-4291) - virsh: fix change-media bug on disk block type - Include process start time when doing polkit checks - qemuDomainChangeGraphics: Check listen address change by listen type - python: return dictionary without value in case of no blockjob - virbitmap: Refactor virBitmapParse to avoid access beyond bounds of array Also the following bug has been fixed : - Fix retrieval of SRIOV VF info, which prevented using some SRIOV virtual functions in guest domains with last seen 2020-06-05 modified 2013-11-09 plugin id 70797 published 2013-11-09 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/70797 title SuSE 11.3 Security Update : libvirt (SAT Patch Number 8421) NASL family Fedora Local Security Checks NASL id FEDORA_2013-18455.NASL description - Allow QoS change with update-device (bz #1014200) - Fix nwfilter crash during firewalld install (bz #1014762) - Fix crash with nographics (bz #1014088) Update to 1.1.3 release - Sync with v1.1.2-maint - Rebuild for libswan soname bump (bz #1009701) - CVE-2013-4311: Insecure polkit usage (bz #1009539, bz #1005332) - CVE-2013-4296: Invalid free memory stats (bz #1006173, bz #1009667) - CVE-2013-4297: Invalid free in NBDDeviceAssociate (bz #1006505, bz #1006511) - Fix virsh block-commit abort (bz #1010056) - Fix snapshot restore when VM has disabled usb support (bz #1011520) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-10-13 plugin id 70408 published 2013-10-13 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/70408 title Fedora 20 : libvirt-1.1.3-2.fc20 (2013-18455) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2013-1272.NASL description Updated libvirt packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. libvirt invokes the PolicyKit pkcheck utility to handle authorization. A race condition was found in the way libvirt used this utility, allowing a local user to bypass intended PolicyKit authorizations or execute arbitrary commands with root privileges. (CVE-2013-4311) Note: With this update, libvirt has been rebuilt to communicate with PolicyKit via a different API that is not vulnerable to the race condition. The polkit RHSA-2013:1270 advisory must also be installed to fix the CVE-2013-4311 issue. An invalid free flaw was found in libvirtd last seen 2020-06-01 modified 2020-06-02 plugin id 69999 published 2013-09-20 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69999 title CentOS 6 : libvirt (CESA-2013:1272)
Redhat
advisories |
| ||||||||
rpms |
|
References
- http://wiki.libvirt.org/page/Maintenance_Releases
- http://rhn.redhat.com/errata/RHSA-2013-1272.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1006173
- http://www.ubuntu.com/usn/USN-1954-1
- http://www.debian.org/security/2013/dsa-2764
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00023.html
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00024.html
- http://rhn.redhat.com/errata/RHSA-2013-1460.html
- http://secunia.com/advisories/60895
- http://security.gentoo.org/glsa/glsa-201412-04.xml
- http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=e7f400a110e2e3673b96518170bfea0855dd82c0