Strix
26.1K

CVE-2013-7336

UnknownEPSS 0.33%

Last modified

CVE-2013-7336 is a vulnerability of currently unknown severity. The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.. EPSS estimates a 0.33% chance of exploitation in the next 30 days.

Description

The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.

Metrics

EPSS Probability
0.33%

24.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
RedhatLibvirt<= 1.1.2
RedhatLibvirt1.0.0
RedhatLibvirt1.0.1
RedhatLibvirt1.0.2
RedhatLibvirt1.0.3
RedhatLibvirt1.0.4
RedhatLibvirt1.0.5
RedhatLibvirt1.0.5.1
RedhatLibvirt1.0.5.2
RedhatLibvirt1.0.5.3
RedhatLibvirt1.0.5.4
RedhatLibvirt1.0.5.5
RedhatLibvirt1.0.5.6
RedhatLibvirt1.0.6
RedhatLibvirt1.1.0
RedhatLibvirt1.1.1
OpensuseOpensuse13.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2013-7336?
The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.
How severe is CVE-2013-7336?
Severity scoring for CVE-2013-7336 is pending analysis. The EPSS model estimates a 0.33% probability of exploitation in the next 30 days.
How do I fix CVE-2013-7336?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2013-7336?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST