It was discovered that an unprivileged user with read-only access to a libvirt guest could connect to it and, by disconnecting, cause a crash of the guest if the access-driver ACLs were defined in libvirtd.conf. This was due libvirtd not removing event callbacks, which would continue to trigger after the client disconnects, which would cause predictable use of free memory, resulting in a crash. This vulnerability was introduced in libvirt 1.1.0 and fixed in 1.1.3 [1]. [1] http://libvirt.org/git/?p=libvirt.git;a=commit;h=8294aa0c1750dcb49d6345cd9bd97bf421580d8b Acknowledgements: This issue was discovered by Zhenfang Wang of Red Hat.
Statement: Not vulnerable. This issue did not affect the versions of libvirt package as shipped with Red Hat Enterprise Linux 5 and 6.