| Reported on: | 20131002 |
|---|---|
| Published on: | 20130927 |
| Fixed on: | 20130927 |
| Reported by: | Zhenfang Wang |
|---|---|
| Patched by: | Daniel Berrange |
When a connection to libvirtd is closed any event handlers registered must be removed. When ACLs were active no identity was set when removing the event handlers, so the operation was denied. Thus event handlers remained connected to a client that had been freed.
An unprivileged user can cause a crash of the libvirtd daemon when ACLs are active by registering one or more event handlers. This leads to a denial of service.
Remove access from unprivileged local users or block access to the event APIs using ACLs