Bug 1042252 (CVE-2013-6436)

Summary:	CVE-2013-6436 libvirt: crash in lxcDomainGetMemoryParameters
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acathrow, berrange, eblake, mmcallis, pfrields, ratulg, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-12-12 21:36:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1049136, 1049137
Bug Blocks:	1042300

Description Petr Matousek 2013-12-12 21:31:56 UTC

The lxcDomainGetMemoryParameters method in the LXC driver did not check whether the guest being accessed was running or not. When shutoff there will be no virCgroupPtr instance associated with the guest. Reading memory tunables involves calling methods with the virCgroupPtr object as a parameter. This will lead to a crash accessing a NULL pointer.

A remote user able to issue commands to libvirt daemon could use this flaw to crash libvirtd.

Acknowledgements:

This issue was discovered by Martin Kletzander of Red Hat.

Comment 1 Petr Matousek 2013-12-12 21:36:23 UTC

Statement:

Not vulnerable.

This issue did not affect the libvirt packages as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 3 Murray McAllister 2014-01-07 05:12:33 UTC

This issue was fixed upstream. Refer to:

https://www.redhat.com/archives/libvir-list/2013-December/msg01161.html
https://www.redhat.com/archives/libvir-list/2013-December/msg01162.html
https://www.redhat.com/archives/libvir-list/2013-December/msg01163.html

Comment 4 Murray McAllister 2014-01-07 05:16:24 UTC

Created libvirt tracking bugs for this issue:

Affects: fedora-all [bug 1049136]