Libvirt Security Notice: LSN-2013-0002

Leak of file descriptors when listing storage volumes

Lifecycle

Credits

See also

• CVE-2013-1962

Description

When listing storage volumes an object was not freed, which caused a libvirt connection to be kept open inside libvirtd. This caused a leak of file descriptors which would eventually exhaust the allowed range.

Impact

A client with a read only connection to libvirtd can cause exhaustion of all file descriptors in libvirtd resulting in a denial of service

Workaround

Prevent untrusted users from accessing libvirtd

Affected product: libvirt

Alternative formats: [xml] [text]